EWF error: failed getting protected volume configuration with error 1.

When you created an image with EWF and run ewfmgr you get the following error message: “Failed getting protected volume configuration with error 1.  incorrect function.”

One reason for this can be that you specified the ARC path for the volume wrong.

You can change the ARC path in the running image in the following registry key:

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesewfParametersProtectedVolume0]
ArcName=multi(0)disk(0)rdisk(0)partition(1)

You can find the naming convention for the ARC Path here: http://support.microsoft.com/kb/102873

 

If it is still not working check the following registry entry:

The UpperFilters key must contain the value Ewf
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
UpperFilters=”Ewf”

After each change make a reboot and try running ewfmgr c: again.