Jump to content

EWF Disk Mode Setup


Recommended Posts

Here correct data to use for some values:



PVConfigs should be set to 2 to indicate that you intend to protect two partitions. PVDisk and PVPart are both REG_MULTI_SZ values. Since you intend to protect {disknumber, partnumber} = {0, 1} and {0, 2} , specify 0 0 for PVDisk and 1 2 for PVPart. Edit using regedit and specify one per line.

Srikanth Kamath [MSFT]



I can confirm with my SCT install:


enabled EWF Disk Mode protects Disk0 Part1 with an overlay size of 8 Gb (8 x 1000 x 1024) decimal 8192000, in hex notation 0x007d0000:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf [30 31 1 17]    Group = System Bus Extender    Start = REG_DWORD 0x00000000    ErrorControl = REG_DWORD 0x00000001    Type = REG_DWORD 0x00000001    FBA [30 31 1 17]        PVConfigs = REG_DWORD 0x00000001        OVSize = REG_DWORD 0x007d0000        OVLevel = REG_DWORD 0x00000001        EnableLazyWrite = REG_MULTI_SZ "1"         PVPart = REG_MULTI_SZ "1"         PVType = REG_MULTI_SZ "0"         PVDiskType = REG_MULTI_SZ "0"         PVOptimize = REG_MULTI_SZ "0"         EwfEnable = REG_MULTI_SZ "1"         PVDisk = REG_MULTI_SZ "0" 
Link to comment
Share on other sites

  • 2 years later...

Maybe I will add a word here.

I have been fighting with installing EWF on live Windows XP system for a few days now and even with the help of this thread I could not manage. Ended up doing a diff between XPe configured to RAM REG and DISK modes.

Long story short: here are the complete installation instructions working on any XP system I tried:

Obtain the following and place the following files into:


Import the following into registry:

Windows Registry Editor Version 5.00

"Group"="System Bus Extender"

; OVSize of Disk overlay partition size in KiB
; PVConfigs how many partitions protected
; PVDisk = ARC number protected disk
; PVDiskType 0=IDE, 1=SCSI
; PVPart ARC number of protected partition
; PVType Ram=31, Disk=30

Then run the following commands:

rundll32 ewfdll.dll, ConfigureEwf
start %systemroot%\fba\fbalog.txt

And finally: replace the \ntldr with ewfntldr.


1. This protects the 1st partition on the first disk.

2. Sets the overlay partition size to 2GB - you need to have unallocated space on the disk for that.

3. The "start %systemroot%\fba\fbalog.txt" line is not necessary but, d***, I wish I found about this sooner.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Create New...