Configuring EWF RAM Reg Mode

Article
10/07/2008

EWF RAM Reg mode stores overlay data in RAM and EWF configuration information in the registry. Because EWF RAM overlays store the data cache in RAM, your device may require additional RAM. Also, because the data cache is stored in volatile memory, the data cache is lost when the system reboots.

Additionally, because EWF configuration information is stored in the registry, which is typically protected by EWF, you must use the ewfmgr -commitanddisable command to apply any changes to EWF.

To configure EWF RAM Reg mode

If you are using FAT16-formatted media, you must use BootPrep to prepare the media. BootPrep updates the boot sector that MS-DOS generated. This allows the media to boot the Windows XP bootloader instead of the MS-DOS bootloader. For more information, see BootPrep. If you are deploying to an NTFS-formatted or FAT32-formatted CompactFlash file system, you do not need to use BootPrep.
Create a working configuration by using Target Designer. To create a configuration, follow the steps that are provided in Tutorial: Building and Deploying a Run-Time Image.
Add the following components to your configuration:
- Background Disk Defragmentation Disable
- Enhanced Write Filter
- EWF Manager Console Application
- Registry Editor (optional)
  
  Creating an EWF RAM Reg overlay requires the addition of some registry keys. You can add the Registry Editor component to your run-time image, or you can update the registry offline by loading the hive on another system.
  
  EWF RAM Reg mode does not require EWF NTLDR. You can add the standard NTLDR to your configuration.
Expand the Enhanced Write Filter component node in the configuration browser pane and select Settings. The EWF Configuration Settings appear in the details pane.
Disable the FBA DLL/COM Registration of the Enhanced Write Filter component.
1. From the View Menu, verify that Resources is checked. Additional configuration resources for the Enhanced Write Filter component appear under the component node.
2. Under the Enhanced Write Filter component, select Resources. The Enhanced Write Filter resources appear in the details pane.
3. Right-click the FBA DLL/COM Registration resource and choose Disable.
  
  This prohibits EWF from creating the EWF volume during the FBA process.
Add command-line support to your run-time image. If you are using the Explorer shell, enable support for the Run command on the Start menu:
1. Expand the User Interface Core component in the configuration browser and choose Settings. The User Interface Core settings appear in the details pane.
2. Select Show Run on Start Menu.
Add the following registry keys to your configuration. You can add these to your configuration as extra resources, you can create a component for these registry keys, or you can update your run-time image post-FBA by using regedit. For more information about how to add this registry key to your configuration, see Adding Registry Data to a Configuration in Windows XP Embedded Studio Help.
- Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0
  
  Name: Enabled
  Type: REG_DWORD
  Value: 0
  
  Name: Type
  Type: REG_DWORD
  Value: 0x00000001 (1)
  
  Name: ArcName
  Type: REG_SZ
  Value: multi(0)disk(0)rdisk(0)partition(1)
Note The entry ArcName is the boot Arc path volume that you want to protect. Change the boot Arc path to protect a different volume on the system.
- Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}
  Name: UpperFilters
  Type: REG_MULTI_SZ
  Value: EWF
  
  Note This key may already exist with the value of volsnap. If the value of this key is volsnap, add EWF to the value. EWF must be on a new line. For example:
  
  Value: volsnap
  ** EWF**
Check dependencies and build the run-time image.
1. Choose Check Dependencies from the Configuration menu. Resolve missing dependencies.
2. Build the run-time image. Choose Build Target Image from the Configuration menu.
The configuration settings for EWF are stored in the registry of the run-time image. When the run-time image is deployed, EWF will be disabled.
Deploy the run-time image to your device, or to the intermediary hard disk where you want to run FBA.

Note You can use an intermediary hard disk to configure FBA for write-sensitive devices such as CompactFlash. Using an intermediary hard disk facilitates the FBA process and reduces the amount of write operations that are made to the device.
Boot the device and allow FBA to finish.
Boot your run-time image.
Verify that the following registry entries exist in your run-time image. If you have Registry Editor on your run-time image, you can run regedit. You can also load the registry hive offline from another system.
1. Verify the registry entries in the key name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf
  
  Name: ErrorControl
  Type: REG_DWORD
  Value: 0x00000001 (1)
  
  Name: Group
  Type: REG_SZ
  Value: System Bus Extender
  
  Name: Start
  Type: REG_DWORD
  Value: 0x00000000 (0)
  
  Name: Type
  Type: REG_DWORD
  Value: 0x00000001 (1)
Reboot your system.
Verify that EWF is properly configured. From the Start menu, choose Run, then type cmd. Then type the following command:
```
ewfmgr c:
```
Ewfmgr should report that EWF is enabled and provide a current status of the EWF RAM overlay.

Note If you are using an intermediary hard disk, copy the run-time image to the CompactFlash device after verifying that EWF is properly configured.

Share via

Configuring EWF RAM Reg Mode

See Also

Additional resources