Resolution for EWF RAM REG "Incorrect Function" issue

[Matt Kellner (MS)]

Hi everyone. Since multiple people have reported this problem, I'm making a
new post regarding a possible solution.

Several of you have reported having difficulties getting EWF RAM REG
configurations working properly. In many of the cases, the problem is that
EWF does not appear to have been configured at all after FBA - if you type
"ewfmgr c:", you might get an error message that includes the words
"Incorrect Function".

A problem has been identified with the RAM REG instructions located at
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/html/xegrfconfiguringewframregoverlays.asp .
In Step 8, the instructions read as follows:

"8. Add the following registry keys to your configuration. You can add these
to your configuration as extra resources, you can create a component for
these registry keys, or you can update your run-time image post-FBA by using
regedit. For more information about how to add this registry key to your
configuration, see Adding Registry Data to a Configuration.
...
* Key Name:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}.
Name: UpperFilters
..."

The problem is in the Key Name - there is a period at the end of the key,
which is a typo. If you copy and paste this key from the MSDN page into
Target Designer, you should make sure you remove the period at the end of
the key when adding the UpperFilters value to your configuration.
Otherwise, the UpperFilters value will be stored in the wrong location and
will be inaccessible to the EWF component, and EWF will not be properly
initialized.

We apologize for this error and any inconvenience it has caused, and we will
take steps to have it corrected as soon as possible. Thanks for bringing
the matter to our attention! I would be interested to see if this helps
resolve your problems. =)

--
Matt Kellner (matt...@online.microsoft.com)
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no rights.
===============================

[Slobodan Brcin (eMVP)]

Hi Matt,

I have asked this, but did not got response today during the chat.
In SP1 versions of EWF this value was filled by script associated with EWF component. This worked flawlessly is there a reason why
you removed that script?

Regards,
Slobodan

"Matt Kellner (MS)" <matt...@microsoft.com> wrote in message news:uPyr7y6E...@tk2msftngp13.phx.gbl...

[Matt Kellner (MS)]

Hi Slobodan. Can you clarify what you're referring to? I'm relatively new
to the EWF component and was not aware of any such scripting in SP1. If you
could point us in the direction of the item you're referring to, we'll see
if we can track it down.

Thanks.

--
Matt Kellner (matt...@online.microsoft.com)
STE, Windows Embedded Group

This posting is provided "AS IS" with no warranties, and confers no rights.
===============================

"Slobodan Brcin (eMVP)" <sbr...@ptt.yu> wrote in message
news:%23WDiU56...@tk2msftngp13.phx.gbl...

[KM]

I think the value has been removed from *Registry section* of the "EWF" component (not from the component script as it does not seem
to have been there).

The UpperFilter value was there for the EWF component version/revision: 5.1.2600/R620 and 5.1.2600.1106/R1507. (and in Hotfix'ed
versions as well).
Interesting that the value was properly created, picking up and adding the current value of the UpperFilter (using a script like
"Split("EWF?" & Join(CurrValue,"?"),"?")").

But the value disappeared from 5.1.2600.2180/R2890 version.

--
Regards,
KM, BSquare Corp.

[Slobodan Brcin (eMVP)]

Konstantin,

> Interesting that the value was properly created, picking up and adding the current value of the UpperFilter (using a script like
> "Split("EWF?" & Join(CurrValue,"?"),"?")").

Correct you are right, it was very long time ago when I needed to look at it last time. But for some mysterious reason I thought
that Split and Join commands were part of vbs script and they are not.
vbs script just set few other values.

Regards,
Slobodan

PS:
Good thing is to know that how to use Split, Join and CurrValue are documented somewhere ;-)

"KM" <konstmor@nospam_yahoo.com> wrote in message news:%23iNiWc7...@TK2MSFTNGP12.phx.gbl...

[Slobodan Brcin (eMVP)]

Hi Matt,

Konstantin pointed the exact line that was removed from new components, just add it please to some QFE update.
Also I wonder why don't you make separate component used only for placing Reg RAM EWF to image, nothing else. I asked this long time
ago for this as well.

Basically you provided vague documentation on how to configure Reg RAM EWF instead of giving the simple component that does all this
correctly.
In doc at least one entry is missing (not mentioned) "Enabled". It is not clear for normal XPe developers how to add EWF value after
volsnap value. Some steps are irrelevant since they are used by dll init call during the FBA which we disable in next step.
Guys if you want to lessen problems both for you and us just make a simple Reg RAM EWF component. Otherwise we will have to deal
with EWF problems all over again needlessly.

Regards,
Slobodan

"Matt Kellner (MS)" <matt...@microsoft.com> wrote in message news:eJM9Mc7E...@tk2msftngp13.phx.gbl...

[Nigel Walker]

The spurious "." was not present in my reg entry but I still haven't got it
to work.

What is this "volsnap" value? I don't have it on my system, is it necessary?
Is that a clue as to why my EWF doesn't work?

Here are the additional registry entries I put into TD, do they look ok?

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\UpperFilters
REG_MULTI_SZ 'EWF'
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0\ArcName
REG_SZ multi(0)disk(0)partition(1)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0\Type
REG_DWORD 0x00000001 (1)

Regards,
Nigel.

"Slobodan Brcin (eMVP)" <sbr...@ptt.yu> wrote in message

news:O5wVhp7E...@TK2MSFTNGP15.phx.gbl...

[Slobodan Brcin (eMVP)]

Nigel,

> What is this "volsnap" value? I don't have it on my system, is it necessary?

It is created by component: "Volume Shadow Copy Service". You do not need it.

Where is value named?
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0\Enabled

Plese could you attach reg files made from regedit on following keys.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf

Regards,
Slobodan

"Nigel Walker" <nawa...@softhome.net> wrote in message news:37gflpF...@individual.net...

[Nigel Walker]

Slobodan,

This could be it!

I don't have a value:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0\Enabled

Should this be a seperate entry in addition to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0

or just added to the end of it?

Regards,
Nigel.

"Slobodan Brcin (eMVP)" <sbr...@ptt.yu> wrote in message

news:O5KhCeAF...@TK2MSFTNGP09.phx.gbl...

[Slobodan Brcin (eMVP)]

Nigel,

Someone reported few days ago that for him without this entry EWF was starting as enabled.

Anyhow it should be

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0

Enabled REG_DWORD 0

If this does not help then try:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EWF\Parameters\Protected\Volume0
VolumeID REG_SZ "{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"

And if this do not help then send us reg files that I asked for.

Regards,
Slobodan

"Nigel Walker" <nawa...@softhome.net> wrote in message news:37gibvF...@individual.net...

[Nigel Walker]

Slobodan,

I tried those entries but they didn't seem to help.

Here are the reg files:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
"Class"="Volume"
"UpperFilters"=hex(7):45,00,57,00,46,00,00,00,00,00
@="Storage volumes"
"SilentInstall"="1"
"Installer32"="syssetup.dll,VolumeClassInstaller"
"Icon"="-53"
"NoInstallClass"="1"
"EnumPropPages32"="StorProp.Dll,VolumePropPageProvider"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\0000]
"InfPath"="volume.inf"
"InfSection"="volume_install"
"ProviderName"="Microsoft"
"DriverDateData"=hex:00,80,62,c5,c0,01,c1,01
"DriverDate"="7-1-2001"
"DriverVersion"="5.1.2600.0"
"MatchingDeviceId"="storage\\volume"
"DriverDesc"="Generic volume"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\0001]
"InfPath"="volume.inf"
"InfSection"="volume_install"
"ProviderName"="Microsoft"
"DriverDateData"=hex:00,80,62,c5,c0,01,c1,01
"DriverDate"="7-1-2001"
"DriverVersion"="5.1.2600.0"
"MatchingDeviceId"="storage\\volume"
"DriverDesc"="Generic volume"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\FBA]
"OVSize"=dword:00000000
"OVLevel"=dword:00000001
"PVConfigs"=dword:00000001
"EwfEnable"=hex(7):30,00,00,00,00,00
"EnableLazyWrite"=hex(7):30,00,00,00,00,00
"PVDisk"=hex(7):30,00,00,00,00,00
"PVPart"=hex(7):31,00,00,00,00,00
"PVDiskType"=hex(7):30,00,00,00,00,00
"PVType"=hex(7):31,00,00,00,00,00
"PVOptimize"=hex(7):30,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0]
"Type"=dword:00000001
"ArcName"="multi(0)disk(0)partition(1)"
"Enabled"=dword:00000000
"VolumeID"="{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Regards,
Nigel.

"Slobodan Brcin (eMVP)" <sbr...@ptt.yu> wrote in message

news:%23jyDU1A...@TK2MSFTNGP10.phx.gbl...

[Slobodan Brcin (eMVP)]

Nigel,

You have used wrong ARC name "multi(0)disk(0)partition(1)" use same as in boot.ini."multi(0)disk(0)rdisk(0)partition(1)"

Regards,
Slobodan

"Nigel Walker" <nawa...@softhome.net> wrote in message news:37gl6kF...@individual.net...

[Nigel Walker]

Slobodan,

It works! I must have been blind as I checked those settings several times,
I just couldn't have noticed the rdisk(0) bit.

Many thanks, I think I owe you several beers!

Regards,
Nigel.

"Slobodan Brcin (eMVP)" <sbr...@ptt.yu> wrote in message

news:uNoXfLBF...@tk2msftngp13.phx.gbl...

[Slobodan Brcin (eMVP)]

Nigel,

I'm glad that we make it work. I guess that I was blind too, since you wrote this ARC path in your first port, I just did not expect
that you entered wrong ARC name so I did not looked at it.
After you sent me complete reg exports I reread all entries and saw this.

Regards,
Slobodan

"Nigel Walker" <nawa...@softhome.net> wrote in message news:37gnimF...@individual.net...