Bilou_Gateux

Here correct data to use for some values: http://social.msdn.microsoft.com/forums/en-US/21904ab0-9efc-45c7-b49b-c0df0656579c/how-to-change-the-protected-partition-with-ewfram-mode- I can confirm with my SCT install: enabled EWF Disk Mode protects Disk0 Part1 with an overlay size of 8 Gb (8 x 1000 x 1024) decimal 8192000, in hex notation 0x007d0000: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf [30 31 1 17] Group = System Bus Extender Start = REG_DWORD 0x00000000 ErrorControl = REG_DWORD 0x00000001 Type = REG_DWORD 0x00000001 FBA [30 31 1 17] PVConfigs = REG_DWORD 0x00000001 OVSize = REG_DWORD 0x007d0000 OVLevel = REG_DWORD 0x00000001 EnableLazyWrite = REG_MULTI_SZ "1" PVPart = REG_MULTI_SZ "1" PVType = REG_MULTI_SZ "0" PVDiskType = REG_MULTI_SZ "0" PVOptimize = REG_MULTI_SZ "0" EwfEnable = REG_MULTI_SZ "1" PVDisk = REG_MULTI_SZ "0"

Microsoft Shared Computer Toolkit for Windows XP, the predecessor to Windows SteadyState was "free". This application [sCT] has been discontinued. From the FAQ http://www.microsoft.com/windowsxp/sharedaccess/faq.mspx During initial installation, EWF [2.0.927] is configured but not enabled (done after reboot when setting Disk Protection) reg dump: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ewf [1 31 17 30] ErrorControl = REG_DWORD 0x00000001 Group = System Bus Extender Start = REG_DWORD 0x00000000 Type = REG_DWORD 0x00000001 Tag = REG_DWORD 0x00000010 FBA PVConfigs = REG_DWORD 0x00000001 OVSize = REG_DWORD 0x00000000 OVLevel = REG_DWORD 0x00000001 EnableLazyWrite = REG_MULTI_SZ "1" PVPart = REG_MULTI_SZ "1" PVType = REG_MULTI_SZ "0" PVDiskType = REG_MULTI_SZ "0" PVOptimize = REG_MULTI_SZ "0" EwfEnable = REG_MULTI_SZ "0" PVDisk = REG_MULTI_SZ "0"