Jump to content

manicalic

Member
  • Posts

    1
  • Joined

  • Last visited

  • Donations

    $0.00 

Posts posted by manicalic

  1. Maybe I will add a word here.

    I have been fighting with installing EWF on live Windows XP system for a few days now and even with the help of this thread I could not manage. Ended up doing a diff between XPe configured to RAM REG and DISK modes.

    Long story short: here are the complete installation instructions working on any XP system I tried:

    Obtain the following and place the following files into:

    %windir%\fba\fba.exe
    %windir%\fba\fbalib.dll
    %windir%\system32\ewfdll.dll
    %windir%\system32\ewfinit.dll
    %windir%\system32\ewfmgr.exe
    %windir%\system32\drivers\ewf.sys

    Import the following into registry:

    Windows Registry Editor Version 5.00
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EWF]
    "ErrorControl"=dword:00000001
    "Group"="System Bus Extender"
    "Start"=dword:00000000
    "Type"=dword:00000001
    
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EWF\FBA]
    "EnableLazyWrite"=hex(7):30,00,00,00,00,00
    "EwfEnable"=hex(7):31,00,00,00,00,00
    "OVLevel"=dword:00000001
    ; OVSize of Disk overlay partition size in KiB
    "OVSize"=dword:00200000
    ; PVConfigs how many partitions protected
    "PVConfigs"=dword:00000001
    ; PVDisk = ARC number protected disk
    "PVDisk"=hex(7):30,00,00,00,00,00
    ; PVDiskType 0=IDE, 1=SCSI
    "PVDiskType"=hex(7):30,00,00,00,00,00
    "PVOptimize"=hex(7):30,00,00,00,00,00
    ; PVPart ARC number of protected partition
    "PVPart"=hex(7):31,00,00,00,00,00
    ; PVType Ram=31, Disk=30
    "PVType"=hex(7):30,00,00,00,00,00

    Then run the following commands:

    rundll32 ewfdll.dll, ConfigureEwf
    start %systemroot%\fba\fbalog.txt

    And finally: replace the \ntldr with ewfntldr.

    Notes:

    1. This protects the 1st partition on the first disk.

    2. Sets the overlay partition size to 2GB - you need to have unallocated space on the disk for that.

    3. The "start %systemroot%\fba\fbalog.txt" line is not necessary but, d***, I wish I found about this sooner.



×
×
  • Create New...