共用方式為

Configuring EWF RAM Reg Mode

  • 發行項

EWF RAM Reg mode stores overlay data in RAM and EWF configuration information in the registry. Because EWF RAM overlays store the data cache in RAM, your device may require additional RAM. Also, because the data cache is stored in volatile memory, the data cache is lost when the system reboots.

Additionally, because EWF configuration information is stored in the registry, which is typically protected by EWF, you must use the ewfmgr -commitanddisable command to apply any changes to EWF.

To configure EWF RAM Reg mode

  1. If you are using FAT16-formatted media, you must use BootPrep to prepare the media. BootPrep updates the boot sector that MS-DOS generated. This allows the media to boot the Windows XP bootloader instead of the MS-DOS bootloader. For more information, see BootPrep. If you are deploying to an NTFS-formatted or FAT32-formatted CompactFlash file system, you do not need to use BootPrep.

  2. Create a working configuration by using Target Designer. To create a configuration, follow the steps that are provided in Tutorial: Building and Deploying a Run-Time Image.

  3. Add the following components to your configuration:

    • Background Disk Defragmentation Disable

    • Enhanced Write Filter

    • EWF Manager Console Application

    • Registry Editor (optional)

      Creating an EWF RAM Reg overlay requires the addition of some registry keys. You can add the Registry Editor component to your run-time image, or you can update the registry offline by loading the hive on another system.

      EWF RAM Reg mode does not require EWF NTLDR. You can add the standard NTLDR to your configuration.

  4. Expand the Enhanced Write Filter component node in the configuration browser pane and select Settings. The EWF Configuration Settings appear in the details pane.

  5. Disable the FBA DLL/COM Registration of the Enhanced Write Filter component.

    1. From the View Menu, verify that Resources is checked. Additional configuration resources for the Enhanced Write Filter component appear under the component node.

    2. Under the Enhanced Write Filter component, select Resources. The Enhanced Write Filter resources appear in the details pane.

    3. Right-click the FBA DLL/COM Registration resource and choose Disable.

      This prohibits EWF from creating the EWF volume during the FBA process.

  6. Add command-line support to your run-time image. If you are using the Explorer shell, enable support for the Run command on the Start menu:

    1. Expand the User Interface Core component in the configuration browser and choose Settings. The User Interface Core settings appear in the details pane.
    2. Select Show Run on Start Menu.

  7. Add the following registry keys to your configuration. You can add these to your configuration as extra resources, you can create a component for these registry keys, or you can update your run-time image post-FBA by using regedit. For more information about how to add this registry key to your configuration, see Adding Registry Data to a Configuration in Windows XP Embedded Studio Help.

    • Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0

      Name: Enabled
      Type: REG_DWORD
      Value: 0

      Name: Type
      Type: REG_DWORD
      Value: 0x00000001 (1)

      Name: ArcName
      Type: REG_SZ
      Value: multi(0)disk(0)rdisk(0)partition(1)

    Note   The entry ArcName is the boot Arc path volume that you want to protect. Change the boot Arc path to protect a different volume on the system.

    • Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}
      Name: UpperFilters
      Type: REG_MULTI_SZ
      Value: EWF

      Note   This key may already exist with the value of volsnap. If the value of this key is volsnap, add EWF to the value. EWF must be on a new line. For example:

      Value: volsnap
      **      EWF**

  8. Check dependencies and build the run-time image.

    1. Choose Check Dependencies from the Configuration menu. Resolve missing dependencies.
    2. Build the run-time image. Choose Build Target Image from the Configuration menu.

    The configuration settings for EWF are stored in the registry of the run-time image. When the run-time image is deployed, EWF will be disabled.

  9. Deploy the run-time image to your device, or to the intermediary hard disk where you want to run FBA.

    Note   You can use an intermediary hard disk to configure FBA for write-sensitive devices such as CompactFlash. Using an intermediary hard disk facilitates the FBA process and reduces the amount of write operations that are made to the device.

  10. Boot the device and allow FBA to finish.

  11. Boot your run-time image.

  12. Verify that the following registry entries exist in your run-time image. If you have Registry Editor on your run-time image, you can run regedit. You can also load the registry hive offline from another system.

    1. Verify the registry entries in the key name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf

      Name: ErrorControl
      Type: REG_DWORD
      Value: 0x00000001 (1)

      Name: Group
      Type: REG_SZ
      Value: System Bus Extender

      Name: Start
      Type: REG_DWORD
      Value: 0x00000000 (0)

      Name: Type
      Type: REG_DWORD
      Value: 0x00000001 (1)

  13. Reboot your system.

  14. Verify that EWF is properly configured. From the Start menu, choose Run, then type cmd. Then type the following command:

    ewfmgr c:

    Ewfmgr should report that EWF is enabled and provide a current status of the EWF RAM overlay.

Note   If you are using an intermediary hard disk, copy the run-time image to the CompactFlash device after verifying that EWF is properly configured.

See Also

EWF Modes | Troubleshooting Enhanced Write Filter | EWF Performance Considerations

Last updated on Wednesday, October 18, 2006

© 2006 Microsoft Corporation. All rights reserved.