Enhanced Write Filter – Installation Batch File

I have created a small batch file which will help you to integrate the Enhanced Write Filter into an existing image.
This batchfile automates the steps which I posted a while ago and makes the integration very easy.

Requirements

The batchfile needs some files to be present which I cannot provide here for download but you can easily extract them by using the Target Designer.

1. Create a folder named ewfinstall
2. Download the Windows Server 2003 Resource Kit
3. Copy the Regini.exe from the Resource Kit to the ewfinstall folder
4. Start Target Designer
5. Add Enhanced Write Filter component
6. Add EWF Manager Console application component
7. Add EWF NTLDR component
8. Add Misc. Command Line Tools component
9. Build the image to any folder
10. copy the following files to the ewfinstall folder
    1. Windowsinfewf.ini
    2. Windowssystem32ewfdll.dll
    3. Windowssystem32ewfinit.dll
    4. Windowssystem32ewfmgr.exe
    5. Windowssystem32driversewf.sys
    6. ntldr
    7. Windowssystem32reg.exe
11. Create a new textfile in notepad, paste the following and save it to the ewfinstall folder with the name EWF_Reg_Config.txt
    

    registrymachine
         SYSTEM
             CurrentControlSet
                 Enum
                     Root [1 5 7 14 17]

12. Create a file named ewf.reg in the ewfinstall folder and paste the following content
    

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINESYSTEM]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001Control]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
    "UpperFilters"=hex(7):45,00,57,00,46,00,00,00,00,00

    [HKEY_LOCAL_MACHINESYSTEMControlSet001Services]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEWF]
    "ErrorControl"=dword:00000001
    "Group"="System Bus Extender"
    "Start"=dword:00000000
    "Type"=dword:00000001

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEWFFBA]
    "OVSize"=dword:00000000
    "OVLevel"=dword:00000001
    "PVConfigs"=dword:00000001
    "EwfEnable"=hex(7):31,00,00,00,00,00
    "EnableLazyWrite"=hex(7):30,00,00,00,00,00
    "PVDisk"=hex(7):30,00,00,00,00,00
    "PVPart"=hex(7):31,00,00,00,00,00
    "PVOptimize"=hex(7):30,00,00,00,00,00
    "PVType"=hex(7):31,00,00,00,00,00

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEWFParameters]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEWFParametersProtected]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEWFParametersProtectedVolume0]
    "Type"=dword:00000001
    "Enabled"=dword:00000000

13. Create a ewfinstall.bat file in the ewfinstall folder and paste the following content

@echo off

echo ————————-
echo EWF Installer
echo created by Wolfgang Unger
echo ————————-

if "%1"=="" GOTO ARG_ERROR
if "%2"=="" GOTO ARG_ERROR

echo Copying EWF files…
copy ewfdll.dll %1Windowssystem32
copy ewfinit.dll %1Windowssystem32
copy ewfmgr.exe %1Windowssystem32
copy ewf.sys %1Windowssystem32drivers
copy ewf.inf %1Windowsinf
copy ntldr "%1"

echo Changing permissions in registry…
regini.exe EWF_Reg_Config.txt

echo Importing registry data…
reg import ewf.reg
reg add  "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEWFParametersProtectedVolume0" /v ArcName /t REG_SZ /d %2 /f

echo Done.
GOTO END

:ARG_ERROR
echo usage ewfinstall.bat Drive ARC-Path
echo       ewfinstall.bat C: multi(0)disk(0)rdisk(0)partition(1)

:END

How to use the script

Run ewfinstall.bat with two arguments

The first argument specifies the drive letter where Windows is installed, e.g. C:

The second argument specifies the ARC Path where Windows is installed, e.g. multi(0)disk(0)rdisk(0)partition(1)
You can find the ARC Path in the boot.ini if you are unsure what to use.

After the script has finished restart the PC.

You can enable the EWF by running ewfmgr c: /enable

del.icio.us Tags: Enhanced Write Filter,XP Embedded,Windows Embedded Standard,EWFMGR,EWF

Installing Windows Embedded Standard (Windows 7 Embedded) in a VHD file

One of the new capabilities of Windows 7 Embedded is to boot from a VHD file. This is a great possibility which can help a lot in case of deploying updates, running different version, or deploying the system in general as it’s again a simple file copy&pasty procedure on NTFS.

You can even install Windows 7 Embedded directly into a VHD so you don’t need to transfer it to a VHD manually – also you don’t need BCDEDIT as the setup will take care of this.

Before you start you need an formatted NTFS volume where the VHD will be located.

Installation

• Boot the target device from the Runtime DVD
• When the setup screen appears pres Shift+F10 – this will open a command prompt
• Run diskpart.exe
• Run the following commands to create a 5GB VHD

create vdisk file=c:Win7Emb.vhd maximum=5120
select vdisk file=c:Win7Emb.vhd
attach vdisk
exit

• close the command prompt and run through your Windows 7 Embedded installation
• select the VHD harddisk at the target drive selection

 

Cloning

The cloning process with VHDs it quite easy:

• format a new hdd with NTFS
• copy the whole content of the target drive where the VHD is located to the new harddisk
  (make sure that you see all the system files – the bootmanager is hidden by default!)

  Example where C is the master drive and D is the new target drive:

robocopy C: D: /E

 

Imageupdates

If you have an update for your image you can easily copy the new VHD to the target harddisk, e.g.:

C:
  — Win7Emb.vhd   [Original Windows 7 Embedded]
  — Win7Emb_v2.vhd  [Updated Windows 7 Embedded Image]

Now you just need to install a new bootentry and set it as default.

bcdedit /copy {default} /d "Updated Windows 7 Embedded Image"
bcdedit /set {GUID} device vhd=[C:]Win7Emb_v2.vhd
bcdedit /set {GUID} osdevice vhd=[C:]Win7Emb_v2.vhd
bcdedit /default {GUID}

If something is wrong with the new image you can easily revert back.