Thread: New EWF + MinLogon and CF instructions

ewf.sys is in System32? Reread step 4 under EWF.

woops.
My Bad..

where does the protected drive get set?

when I run ewfmgr c: from console
I get the error:
Failed getting protected volume configuration with error 1

any ideas?
I have checked the registry and this is fine and matches up with the registry in the document. ewf.sys is also now in the correct folder.

is this correct?

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Session Manager]
BootExecute=""

yes, that registry value just prevents automatic scandisk on bootup. so you have EWF installed now? And your reg values are all correct? Did you remove all other harddrives from your system when you booted up? Is your EWF drive the c: drive?

I have only one hard drive 20gb C: drive and it is set up on the primary IDE.
The C drive is the EWF drive.

The Reg velues exactly match up with the ones noted in the document.
The boot.ini [boot loader]
matches the ArcName with the exception it has "\WINDOWS" at the end.

Hmm... as long as you know the reg values match up with the system config then you should be fine. Try shutting down and doing a cold boot. You've only got one partition on the drive?

yup only one partition on that drive.
Tried a cold boot with no luck..

On section 5 you say you can disable the startup recovery but dont say how?

Do you know if knubile has tried these steps yet? or is he still waiting for his new CF card to arrive?

Would unistalling XPE make any difference or was the XPE installation only used to get the files needed for EWF?

I havent installed Nlite yet there arent any settings there that would of made a difference?

These instructions aren't much different from any other instructions. I just removed some useless registry values and added a few more for the scandisk and some other boot options. Unfortunately, without being there there's not much I can do to debug this. I've run through these EXACT instructions numerous times so I know they're good to go. Do you mean the XPe tools? That won't make a difference. You didn't actually make an XPe image, did you? The Startup and Recovery options are in the same spot as the Performance options. Just click on Startup and Recovery button and you'll see the checkboxes there. I would recommend you redo the whole EWF process from start to finish exactly as it is in the document.

http://test.crimsonstain.net/EWF.zip
Downloaded these files provided by SWC.

It appears I was using the wrong ewf.sys and ewfmgr.exe from XPE?
Not sure why my XPE is different but did a search from the repositories dir and the ones I have are older than SWC`s but were the only latest ones in the XPE repository directory that I had.

Good news its now working onto the next step.
Sorry for being a pain SFiorito..

Cos there isnt much else I can do, I have designed some stuff for you that you may want to use with your carputer?
sfiorito jpg image
sfiorito photoshop file