Enhanced Write Filter – Installation Batch File

I have created a small batch file which will help you to integrate the Enhanced Write Filter into an existing image.
This batchfile automates the steps which I posted a while ago and makes the integration very easy.

Requirements

The batchfile needs some files to be present which I cannot provide here for download but you can easily extract them by using the Target Designer.

1. Create a folder named ewfinstall
2. Download the Windows Server 2003 Resource Kit
3. Copy the Regini.exe from the Resource Kit to the ewfinstall folder
4. Start Target Designer
5. Add Enhanced Write Filter component
6. Add EWF Manager Console application component
7. Add EWF NTLDR component
8. Add Misc. Command Line Tools component
9. Build the image to any folder
10. copy the following files to the ewfinstall folder
    1. Windowsinfewf.ini
    2. Windowssystem32ewfdll.dll
    3. Windowssystem32ewfinit.dll
    4. Windowssystem32ewfmgr.exe
    5. Windowssystem32driversewf.sys
    6. ntldr
    7. Windowssystem32reg.exe
11. Create a new textfile in notepad, paste the following and save it to the ewfinstall folder with the name EWF_Reg_Config.txt
    

    registrymachine
         SYSTEM
             CurrentControlSet
                 Enum
                     Root [1 5 7 14 17]

12. Create a file named ewf.reg in the ewfinstall folder and paste the following content
    

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINESYSTEM]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001Control]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
    "UpperFilters"=hex(7):45,00,57,00,46,00,00,00,00,00

    [HKEY_LOCAL_MACHINESYSTEMControlSet001Services]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEWF]
    "ErrorControl"=dword:00000001
    "Group"="System Bus Extender"
    "Start"=dword:00000000
    "Type"=dword:00000001

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEWFFBA]
    "OVSize"=dword:00000000
    "OVLevel"=dword:00000001
    "PVConfigs"=dword:00000001
    "EwfEnable"=hex(7):31,00,00,00,00,00
    "EnableLazyWrite"=hex(7):30,00,00,00,00,00
    "PVDisk"=hex(7):30,00,00,00,00,00
    "PVPart"=hex(7):31,00,00,00,00,00
    "PVOptimize"=hex(7):30,00,00,00,00,00
    "PVType"=hex(7):31,00,00,00,00,00

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEWFParameters]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEWFParametersProtected]

    [HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEWFParametersProtectedVolume0]
    "Type"=dword:00000001
    "Enabled"=dword:00000000

13. Create a ewfinstall.bat file in the ewfinstall folder and paste the following content

@echo off

echo ————————-
echo EWF Installer
echo created by Wolfgang Unger
echo ————————-

if "%1"=="" GOTO ARG_ERROR
if "%2"=="" GOTO ARG_ERROR

echo Copying EWF files…
copy ewfdll.dll %1Windowssystem32
copy ewfinit.dll %1Windowssystem32
copy ewfmgr.exe %1Windowssystem32
copy ewf.sys %1Windowssystem32drivers
copy ewf.inf %1Windowsinf
copy ntldr "%1"

echo Changing permissions in registry…
regini.exe EWF_Reg_Config.txt

echo Importing registry data…
reg import ewf.reg
reg add  "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEWFParametersProtectedVolume0" /v ArcName /t REG_SZ /d %2 /f

echo Done.
GOTO END

:ARG_ERROR
echo usage ewfinstall.bat Drive ARC-Path
echo       ewfinstall.bat C: multi(0)disk(0)rdisk(0)partition(1)

:END

How to use the script

Run ewfinstall.bat with two arguments

The first argument specifies the drive letter where Windows is installed, e.g. C:

The second argument specifies the ARC Path where Windows is installed, e.g. multi(0)disk(0)rdisk(0)partition(1)
You can find the ARC Path in the boot.ini if you are unsure what to use.

After the script has finished restart the PC.

You can enable the EWF by running ewfmgr c: /enable

del.icio.us Tags: Enhanced Write Filter,XP Embedded,Windows Embedded Standard,EWFMGR,EWF