Using EWF on regular WinXP

**SFiorito** · 11-26-2004, 11:37 AM

knubile... what I tried to do was run -commitanddisable -live which commits changes and disables ewf right away (the live switch), then run -enable (which will enable ewf at the next bootup), and then hibernate. Only problem is ewf doesn't get a chance to enable again before the coming out of hibernation process. I'm guessing that the special ntldr for ewf is what makes the changes, but the hibernation process must come before ewf. I'm also trying to figure out where ewf keeps its state, because the registry values don't change from ewfmgr calls, but ewf must keep its state somewhere.

I may take a look at this readyon as well...

**SFiorito** · 11-26-2004, 12:03 PM

Okay... we're going to feel really dumb now. Doing a few searches on google I found some people trying to use hibernation with EWF on XP Embedded. It turns out that hibernation bypasses EWF when it writes the hibernation file!! The even better part is that it keeps that state throughout reboots! So you don't need to rehibernate again and again (causing writes which is bad for CF cards). So we're set!!! All you need to do is hibernate once with EWF enabled. Then you can just reboot, pull the plug and restart, whatever you want!

**knubile** · 11-26-2004, 12:15 PM

HAHA. You've got to be kidding. I'm going to try that right now.

**knubile** · 11-26-2004, 12:39 PM

Can you post a link to where you read the info SFiorito?

**SFiorito** · 11-26-2004, 12:46 PM

this is a longass thread, but these two guys cover everything: http://groups.google.com/groups?hl=e...gbl%26rnum%3D4

**knubile** · 11-26-2004, 12:47 PM

I got a BSOD trying to return from hibernate. I'm using VMWare on a dell laptop. I think the failure is from VMWare. its some vmware dll mention in the BSOD. Is anybody trying this outside of VMWare and VirtualPC (ie. a real install)?

**SFiorito** · 11-26-2004, 12:58 PM

yeah, i got mine to work from my via system. haven't tried it in virtualpc yet.

**knubile** · 11-26-2004, 04:02 PM

So you have your via system hibernated once and resuming from the same hiberfil.sys everytime?

**SFiorito** · 11-26-2004, 04:05 PM

yeah. i had a basic WinXP SP2 install on my via system. I did the EWF process and made sure it worked. Then I just hibernated, rebooted, and it came up fine. I did a normal restart and even just switched the power off and on again and it still resumes from the same hibernation file.

**knubile** · 11-26-2004, 04:55 PM

Awesome! I'm going to do that to my system ASAP. Now I can put my laptop drive in a USB enclosure and take it out of the car.
Time to buy a CF card or IDE flash drive.