How to integrate/remove EWF in a running XPe image

Installation

1. Copy the following files from your Repository to your target device.

Filename	Targetdirectory + filename
ewfdll.dll	Windowssystem32ewfdll.dll
ewfinit.dll	Windowssystem32ewfinit.dll
ewfmgr.exe	Windowssystem32ewfmgr.exe
ewf.sys	Windowssystem32driverewf.sys
ewf.inf	Windowsinfewf.inf
ewfntldr	ntldr

2. Run regedit.exe

Right click on the key HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRoot and select permissions.

Change the permissions for your user to full and click apply.

3. Copy the following and change %ProtectedVolume% to the ARC path of the Volume you want to protect. You can find the ARC path for the boot volume in the boot.ini – it will look like this ”multi(0)disk(0)rdisk(0)partition(1)”

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESYSTEM]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSet]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControl]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
"UpperFilters"=hex(7):45,00,57,00,46,00,00,00,00,00

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEWF]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEWFFBA]
"OVSize"=dword:00000000
"OVLevel"=dword:00000001
"PVConfigs"=dword:00000001
"EwfEnable"=hex(7):31,00,00,00,00,00
"EnableLazyWrite"=hex(7):30,00,00,00,00,00
"PVDisk"=hex(7):30,00,00,00,00,00
"PVPart"=hex(7):31,00,00,00,00,00
"PVOptimize"=hex(7):30,00,00,00,00,00
"PVType"=hex(7):31,00,00,00,00,00

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEWFParameters]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEWFParametersProtected]
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEWFParametersProtectedVolume0]
"Type"=dword:00000001
"ArcName"="%ProtectedVolume%"
"Enabled"=dword:00000000

4. Import the saved registry file.

5. Reboot

The EWF should be integrated now into you image but it is disabled by default. You can enable it by running ewfmgr c: /enable

 

Removal

1. Locate the following files on your target device and delete them

Filename

Windowssystem32ewfdll.dll

Windowssystem32ewfinit.dll

Windowssystem32ewfmgr.exe

Windowssystem32driverewf.sys

Windowsinfewf.inf

ntldr

2. Copy the ntldr from your Repository to the target devices root directory.

3. Run regedit.exe

4. Remove EWF from the following key

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
"UpperFilters"

5. Delete the following key in the registry

[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEWF]

6. Reboot

The EWF should be completely removed from your system now. Please do not forget to copy over the ntldr before rebooting!

Cannot access CD/DVD drive with Windows Explorer

When you try to explore the content of a DVD or CD drive in XP Embedded with your Windows explorer nothing happens or the explorer will automatically jumps to the next item in the folder list. By using the command line you can access the CD/DVD drive without problem and you are able to run applications too.

This behavior is can be caused if you have a CD/R(W) drive and you added the IMAPI – CD Burning component and use Minlogon. In this case Windows tries to access the temporary write cache which is normally located in the documents and settings folder for the user but with Minlogon this folder does not exist.

To resolve this error just open the properties of the CD/R(W) drive and go to the Recording tab. In this tab disable the “Enable CD recording on this device” checkbox and click ok. Now you can access the CD/DVD drive again.