[EWF Disk Mode Setup]

Maybe I will add a word here.

I have been fighting with installing EWF on live Windows XP system for a few days now and even with the help of this thread I could not manage. Ended up doing a diff between XPe configured to RAM REG and DISK modes.

Long story short: here are the complete installation instructions working on any XP system I tried:

Obtain the following and place the following files into:

%windir%\fba\fba.exe
%windir%\fba\fbalib.dll
%windir%\system32\ewfdll.dll
%windir%\system32\ewfinit.dll
%windir%\system32\ewfmgr.exe
%windir%\system32\drivers\ewf.sys

Import the following into registry:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EWF]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EWF\FBA]
"EnableLazyWrite"=hex(7):30,00,00,00,00,00
"EwfEnable"=hex(7):31,00,00,00,00,00
"OVLevel"=dword:00000001
; OVSize of Disk overlay partition size in KiB
"OVSize"=dword:00200000
; PVConfigs how many partitions protected
"PVConfigs"=dword:00000001
; PVDisk = ARC number protected disk
"PVDisk"=hex(7):30,00,00,00,00,00
; PVDiskType 0=IDE, 1=SCSI
"PVDiskType"=hex(7):30,00,00,00,00,00
"PVOptimize"=hex(7):30,00,00,00,00,00
; PVPart ARC number of protected partition
"PVPart"=hex(7):31,00,00,00,00,00
; PVType Ram=31, Disk=30
"PVType"=hex(7):30,00,00,00,00,00

Then run the following commands:

rundll32 ewfdll.dll, ConfigureEwf
start %systemroot%\fba\fbalog.txt

And finally: replace the \ntldr with ewfntldr.

Notes:

1. This protects the 1st partition on the first disk.

2. Sets the overlay partition size to 2GB - you need to have unallocated space on the disk for that.

3. The "start %systemroot%\fba\fbalog.txt" line is not necessary but, d***, I wish I found about this sooner.