EWF Disk Mode Setup in Windows XP Posted June 20, 2016 Maybe I will add a word here. I have been fighting with installing EWF on live Windows XP system for a few days now and even with the help of this thread I could not manage. Ended up doing a diff between XPe configured to RAM REG and DISK modes. Long story short: here are the complete installation instructions working on any XP system I tried: Obtain the following and place the following files into: %windir%\fba\fba.exe %windir%\fba\fbalib.dll %windir%\system32\ewfdll.dll %windir%\system32\ewfinit.dll %windir%\system32\ewfmgr.exe %windir%\system32\drivers\ewf.sys Import the following into registry: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EWF] "ErrorControl"=dword:00000001 "Group"="System Bus Extender" "Start"=dword:00000000 "Type"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EWF\FBA] "EnableLazyWrite"=hex(7):30,00,00,00,00,00 "EwfEnable"=hex(7):31,00,00,00,00,00 "OVLevel"=dword:00000001 ; OVSize of Disk overlay partition size in KiB "OVSize"=dword:00200000 ; PVConfigs how many partitions protected "PVConfigs"=dword:00000001 ; PVDisk = ARC number protected disk "PVDisk"=hex(7):30,00,00,00,00,00 ; PVDiskType 0=IDE, 1=SCSI "PVDiskType"=hex(7):30,00,00,00,00,00 "PVOptimize"=hex(7):30,00,00,00,00,00 ; PVPart ARC number of protected partition "PVPart"=hex(7):31,00,00,00,00,00 ; PVType Ram=31, Disk=30 "PVType"=hex(7):30,00,00,00,00,00 Then run the following commands: rundll32 ewfdll.dll, ConfigureEwf start %systemroot%\fba\fbalog.txt And finally: replace the \ntldr with ewfntldr. Notes: 1. This protects the 1st partition on the first disk. 2. Sets the overlay partition size to 2GB - you need to have unallocated space on the disk for that. 3. The "start %systemroot%\fba\fbalog.txt" line is not necessary but, d***, I wish I found about this sooner.