Thread: New EWF + MinLogon and CF instructions

Good jobs...I am newbi.

Hey guys - new here to MP3car, but surely not computing. I am a software engineer and enjoy playing with Windows in my free time. Other hobbies include mountain biking, home audio, and cars of course. My ride is a black 2000 Ford Contour SVT.

Now for info that pertains to this thread....

I am running XP Pro on a 4GB CF. I have minlogon and EWF running in disk mode.
I have the C: drive protected and EWF creates a second partition to write files to.
I also wrote my own shell and thats where my question comes in...

If I kill my OS with EWF running(enabled) via a normal shutdown or just drop power, then take the CF to my laptop, update my shell, remove the card from the laptop and boot it back up - it runs my old shell even though I replaced the shell exe file. ????? Technically, the old shell file shouldn't even exist since I replaced it with a new identically named file, but Windows sure seems to find and run it without a problem!
If you look at the shell file itself while running the OS, it is the old file date, not the new one.

If I run a "ewfmgr c: -restore" which wipes everything off the disk overlay(the writable partition) and reboot my new shell then runs and the file date is updated to the new shell.

Does EWF somehow shadow or archive certain files???

I thought it was something interesting - didn't know if any of you folks had ran into it.

where do you get them!

I've downloaded the XPe trial from MS, installed got the repositories etc, but no matter what i do, even following instructions to the letter i always get error sate 1 where no EWF volume found.

from reading i gather this may be because i am using out of date versions, so where do i get the new ones if they dont come in the package from MS?

the ewfntldr
ewf.sys
ewfmgr.exe are all last modifed in 2003, there are also older versions fomr 2001 in the repo but nothing more recent.

thanks for your help!

Originally Posted by amedias

where do you get them!

I've downloaded the XPe trial from MS, installed got the repositories etc, but no matter what i do, even following instructions to the letter i always get error sate 1 where no EWF volume found.

from reading i gather this may be because i am using out of date versions, so where do i get the new ones if they dont come in the package from MS?

the ewfntldr
ewf.sys
ewfmgr.exe are all last modifed in 2003, there are also older versions fomr 2001 in the repo but nothing more recent.

thanks for your help!

Those are the files I used. They are all dated 1/17/2003.

thanks a lot for clarifying that for me...

in that case, any ideas why mine isnt working?

ta
matt

I'm a newbie in this hobby, but have setup a computer running Win XP Pro, and CentraFuse.
I have had my misfortunes along the way to get a running solution, and the main problem has always been related to an unstable car environment and power.
However the solution of running XPe with the EWF filter sounds like it will solve problems of an ustable environemt...

Although there are a lot of focus on XPe and EWF using CF as boot drive, could XPe and EWF be used with the same success using Disc On Module or for that matter ordinary HardDrives?
The main advantages I see in this solution, is that the OS and software installed remain unchanged and stable no matter what happens to the computer (eg. sudden loss of power...).
What are the disadvantages?
Am I missing something?

EPIA CN13000 Mobo
Primary Drive a 4GB Disc On Module
Secondary Drive a 2GB Disc On Module
M2-ATX Power

Thanks
Petter

Originally Posted by amedias

thanks a lot for clarifying that for me...

in that case, any ideas why mine isnt working?

ta
matt

You are trying to get EWF running on XP Pro right?

If so, go to the first page and review SFiorito's instructions (first post has a link to a htm doc). They are very good and if followed to the "T" it should work fine for you.

I did get burnt when messing with mine on one registry setting. It caused infinite rebooting on my system....

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
"UpperFilters"="Ewf"

I just added the EWF entry in and left the VolSnap entry with it. Bad idea! Make sure EWF is the only entry in there. After removing VolSnap I was good to go.