EWF for Win7, 3 steps made easy (works with RTM!)

I got tired of sifting through all the EWF posts/info, so I thought I'd make a simple thread for everyone to enjoy!

*EDIT: Forgot to mention this before, but I'm using build 7048; although it should work on any build.

Step 1
First you need to make a few registry entries:

Key name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf (the \ewf key is not there by default, you have to make it)

Name: ErrorControl
Type: REG_DWORD
Value: 0x00000001 (1)

Name: Group
Type: REG_SZ
Value: System Bus Extender

Name: Start
Type: REG_DWORD
Value: 0x00000000 (0)

Name: Type
Type: REG_DWORD
Value: 0x00000001 (1)

Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0 (the \Parameters\Protected\Volume0 keys are not there by default, you have to add them)

Name: Enabled
Type: REG_DWORD
Value: 0

Name: Type
Type: REG_DWORD
Value: 0x00000001 (1)

Name: ArcName
Type: REG_SZ
Value: multi(0)disk(0)rdisk(0)partition(2) ***see note below***

Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}

Name: UpperFilters (you have to make this one too)
Type: REG_MULTI_SZ
Value: EWF


***the note below***
Only set this to 2 if you did a standard Win7 install that included the 200MB partition, otherwise set it to 1.

Step 2
Now, you need this ISO here: http://www.microsoft.com/downloads/...ea-a37e-4d25-83df-aabbaa78914f&displaylang=en

Mount the ISO (I used d-tools) and open xpefp2007.exe with a archive program (I used winrar). In the "rep" directory get the files: ewf.sys & ewfmgr.exe

ewf.sys goes in \windows\system32\drivers
ewfmgr.exe goes in \windows\system32

Check that you made all the correct entries.
Check them again!
Reboot! (to insure you didn't f-up)

Step 3
Once back into windows, open a command prompt and type the following:

ewfmgr c: -enable

It'll spit out something (can't remember exactly) but close your prompt and... Reboot!

If all's well and you did everything correctly, EWF should be enabled and your Win7 AAO should now be blazin' fast!


Good luck, and have fun!




Questions/comments? Post!

 

Re: EWF for Win7, 3 steps made easy

Holy Mother of .....

EWF in Windows 7,.. thanks a million dude!

Two quick tips that I found though.... You have to have UAC turned off in order to run EWFMGR properly, if you try to run ewfmgr c: -enable before turning off UAC, you end up with an error like unable to access target device //./c error (5) or something like that.

Turning off UAC in Windows 7 is about the same as in Vista, but if you need a refresher, click here:
http://www.mydigitallife.info/2008/12/3 ... windows-7/

One thing I noticed though is that with UAC off, you no longer can add Gadgets to the desktop... working on getting that sorted out now, will advise.

Thanks again!

 

Re: EWF for Win7, 3 steps made easy

Hmm, that was easy research...

Here is the info to get Gadgets and Sidebar working with UAC off, I downloaded and ran the .reg file, seemed to work fine for me. Enjoy!

http://www.mydigitallife.info/2009/01/2 ... -properly/

 

Re: EWF for Win7, 3 steps made easy

Yea good call on the UAC, but I didn't turn my off, I just set the slider to its lowest setting. That way gadgets still work and you don't have to worry about erros when you use ewfmgr. I'm using 7048 so the gadget issue might be for other builds.

 

Re: EWF for Win7, 3 steps made easy

Actually, the slider at the bottom is turning UAC off.

I am working on getting the winsxs directory moved to the SD card at the moment. The Vista procedures don't seem to work because the TrustedInstaller service has a higher level of protection than in Vista. If I can figure it out, that'll get us another 3GB of space.. will see how that goes and will report back.

 

Re: EWF for Win7, 3 steps made easy

I have to post a thx for this thread. my AAO has seen many OS changes and EWF mod in the past. But after my battrey did in the middle of a -commit shutdown and sent my xp to the graveyard, i went back the stock acer linux out of frustration. after running w7 on my desktop i thought it was time for a switch. i then put on w7 with a vlite diet, and it seemed faster the both xp and vista without the ewf. but after comming across your ewf posting i thought if might be time to give is a shot.

the result is a w7 OS that has the fell of my quad core desktop, THIS THING FLYS. whats the point of of a ewf xp setuo when w7 runs just as fast if not faster with all the bells and whistles?

i still dont know the future of my AAO in my current system lineup. once a dual core atom with nvidia's ion chipset comes along my AAO will be off my lap for good, but until then, this is it.

 

Re: EWF for Win7, 3 steps made easy

I have followed the instructions to the dot, but when I go to cmd prompt and type ewfmgr c: -enable, I get the error message "failed getting protected volume configuration with error 1".
Does anyone know what I am doing wrong?

 

Re: EWF for Win7, 3 steps made easy

Never tried this before. Is this the correct report?

C:\Users\AspireOne>ewfmgr c: -enable
*** Enabling overlay

Protected Volume Configuration
Type RAM (REG)
State DISABLED
Boot Command ENABLE
Param1 0
Param2 0
Volume ID 4F B8 4E 5B 00 00 90 0C 00 00 00 00 00 00 00 00
Device Name "\Device\HarddiskVolume2" [C:]
Max Levels 1
Clump Size 512
Current Level N/A

Memory used for data 0 bytes
Memory used for mapping 0 bytes

Edit: After a reboot, I get this:

C:\Users\AspireOne>ewfmgr
RAM (REG) Configuration
Device Name "\Device\HarddiskVolume2" [C:]
HORM Not supported

 

Re: EWF for Win7, 3 steps made easy

You need to type "ewfmgr c:" to show its status.

 

Re: EWF for Win7, 3 steps made easy

Shameless bump for those having ewf issues.

Btw, I updated to the RC, then the RTM and this still works.

 

Hi everyone,
no one having this strange non commit reboot issue... "Windows did not start properly" or something?
Ok, redid my Win7 today, one partition, RTM without any changes (ok, german language pack, but thats not the problem for sure. :lol: )
Will now add exactly (and only) the reg entrys posted here and see if my prob returns.
I'm not the only one having this and some Guys in this forum shared their thoughts bout this.

In my reg-file i had some entrys more, but maybe they are only neccessary when using XP... (like replacing ntldr)
Will submit my result later...

greets, TT

 

NOOOOOOOOO,
I dit it EXACTLY how you explained it in your first Post, -enable --- reboot --- EWF works --- reboot --- Windows could not start screen with repair option highlighted. When i choose to start Windows normaly it works like a charm, but i couldn't get rid of this error screen apearing EVERYTIME I boot without having comitted on last shutdown.
Think before EWF starts some bootlog is written or something...
Any Ideas?

greets TT

 

You have to delete the file "bootstat.dat" (hidden file)

 

Does anyone know if this works for 64 bit Windows 7 (my Lenovo laptop runs it not my Acers) ?