EwfVolumeConfiguration Class (Standard 7 SP1)
7/8/2014
The EwfVolumeConfiguration class provides information about the configuration of a volume.
The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties.
Syntax
class EwfVolumeConfiguration
{
uint32 BootCommand;
string BootCommandName;
uint32 BootCommandParam1;
uint32 BootCommandParam2;
uint32 ClumpSize;
uint32 CurrentLevel;
sint64 DiskOverlayDataSize;
sint64 DiskOverlayMapSize;
string DriveLetter;
string HormState;
uint8[] Identifier;
uint32 MaximumLevels;
uint32 MemoryMapSize;
string Name;
uint8[] PersistentData;
sint64 RamOverlayDataSize;
uint32 State;
string StateName;
uint32 Type;
string TypeName;
};
Members
The EwfVolumeConfiguration class defines the following types of members:
- Properties
Properties
The Ewf class defines the following properties.
BootCommand
Data type: uint32
Access type: Read-only
Returns the boot command to be executed on restart.
Value
Description
0
EWF_NO_CMD
1
EWF_ENABLE
2
EWF_DISABLE
3
EWF_SET_LEVEL
4
EWF_COMMIT
BootCommandName
Data type: string
Access type: Read-only
Returns the boot command to be executed on restart. The command can be "NO_CMD", "ENABLE", "DISABLE", "SET_LEVEL", or "COMMIT".
BootCommandParam1
Data type: uint32
Access type: Read-only
Returns the first parameter of the boot command.
BootCommandParam2
Data type: uint32
Access type: Read-only
Returns the second parameter of the boot command.
ClumpSize
Data type: uint32
Access type: Read-only
Returns the size of the clumps, in bytes. The default value is 512 bytes.
CurrentLevel
Data type: uint32
Access type: Read-only
Returns the current checkpoint level. If the overlay type is "RAM" or "RAM Reg", this always returns 1 for active overlays.
DiskOverlayDataSize
Data type: sint64
Access type: Read-only
Returns the size of the data to be stored on disk for the protected volume, in bytes. If the overlay type is "RAM" or "RAM Reg", this always returns 0.
DiskOverlayMapSize
Data type: sint64
Access type: Read-only
Returns the size of the mapping data on disk for the protected volume, in bytes. If the overlay type is "RAM" or "RAM Reg", this always returns 0.
DriveLetter
Data type: string
Access type: Read-only
Returns the drive letter of the volume.
HormState
Data type: string
Access type: Read-only
Returns the state of the HORM functionality. The state can be either "Enabled" or "Disabled".
Identifier
Data type: uint8[]
Access type: Read-only
Returns the volume identifier.
MaximumLevels
Data type: uint32
Access type: Read-only
Returns the maximum number of checkpoint levels in the overlay.
MemoryMapSize
Data type: uint32
Access type: Read-only
Returns the size of the mapping data that is contained in memory for the protected volume, in bytes.
Name
Data type: string
Access type: Read-only
Qualifiers: Key
Returns the name of the volume.
PersistentData
Data type: uint8[]
Access type: Read/write
Data that persists through disable, enable, and restore operations. The size of persisted data is supported up to 32 bytes.
RamOverlayDataSize
Data type: sint64
Access type: Read-only
Returns the size of the data to be stored in RAM for the protected volume, in bytes. If the overlay type is "Disk", this always returns 0.
State
Data type: uint32
Access type: Read-only
Returns the state of the overlay for the volume.
Value
Description
0
Enabled
1
Disabled
StateName
Data type: string
Access type: Read-only
Returns the state of the overlay for the volume. The state can be either "Enabled" or "Disabled".
Type
Data type: uint32
Access type: Read-only
Returns the type of overlay for the volume.
Value
Description
0
Disk
1
RAM
2
RAM Reg
TypeName
Data type: string
Access type: Read-only
Returns the type of overlay for the volume. The type can be "Disk", "RAM", or "RAM-Reg".
Remarks
When querying for property values with a uint64 or sint64 data type in a scripting language such as VBScript, WMI returns string values. Unexpected results can occur when comparing these values, because comparing strings returns different results than comparing numbers. For example, "10000000000" is less than "9" when comparing strings, and 9 is less than 10000000000 when comparing numbers. To avoid confusion you should use the CDbl method in VBScript when properties of type uint64 or sint64 are retrieved from WMI.
Example
This example can be used to enumerate all instances of EwfVolumeConfiguration.
Windows PowerShell
$ComputerName="localhost" # or "remote-machine-name"
$Namespace = "root\Microsoft\WriteFilters"
$Class = "EwfVolumeConfiguration"
Write-Host "Retrieving EWF volume configurations..."
$EwfVolumes = Get-WmiObject `
-ComputerName $ComputerName `
-Namespace $Namespace `
-Class $Class
Write-Host "The following volume configurations were found: "
foreach ($EwfVolume in $EwfVolumes) {
Write-Output $EwfVolume `
}
VBScript
strComputer = "localhost" ' or "remote-machine-name"
strNamespace = "\root\Microsoft\WriteFilters"
strClass = "EwfVolumeConfiguration"
On Error Resume Next
Set EwfVolumes = GetObject("WINMGMTS:\\" & strComputer & _
strNamespace).InstancesOf(strClass)
If Err.number <> 0 Then
WScript.Echo "Method exited with error code: 0x" & Hex(Err.number)
WScript.Echo Err.source & " - " & Err.Description
WScript.Quit(1)
End If
For Each EwfVolume In EwfVolumes
For Each Prop In EwfVolume.Properties_
If IsArray(Prop) Then
WScript.Echo Prop.Name, ": {", Join(Prop.Value, ","), "}"
Else
WScript.Echo Prop.Name, ": ", Prop.Value
End If
Next
WScript.Echo "--------------------------------"
Next
Requirements
Supported clients |
Windows XP Embedded SP3 |
MOF |
EWFProvider.mof |
Namespace |
\root\Microsoft\WriteFilters |