无法在 Windows Embedded Standard 上启用 EWF
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/5245586/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Cannot Enable EWF on Windows Embedded Standard
提问by Emi
Hi we bought a HP PC with MS Windows Embedded Standard-HP Customized and we have a problem with enabling the EWF function. If I try to check the EWF status with EMF Manager:
您好，我们购买了带有 MS Windows Embedded Standard-HP Customized 的 HP 电脑，但我们在启用 EWF 功能时遇到了问题。如果我尝试使用 EMF Manager 检查 EWF 状态：
ewfmgr c:
I get error:
我得到错误：
“Failed getting protected volume configuration with error 1. incorrect function.”
If I try to enable EWF with commad:
如果我尝试使用命令启用 EWF：
ewfmgr c -enable
I get error:
我得到错误：
Failed opening the target device \.\c with error 2
The system cannot find the file specified.
I tried to use HP utility - HP Write Filter Configuration to enable EWF.
我尝试使用 HP 实用程序 - HP Write Filter Configuration 来启用 EWF。
But when I enabled EWF with this utility, restart PC and EWF is disable.
但是当我使用此实用程序启用 EWF 时，重新启动 PC 并且 EWF 被禁用。
Only FBWF is working.
只有 FBWF 正在工作。
What can be bad? Any idea?
什么可能是坏的？任何的想法？
回答by PhilMY
In modes other than "Reg RAM", EWF needs a special version of the Windows bootloader (NTLDR) and some unpartitioned disk space for creating an overlay volume. I don't know whether your HP PC has been configured with those.
在“Reg RAM”以外的模式中，EWF 需要特殊版本的 Windows 引导加载程序 (NTLDR) 和一些未分区的磁盘空间来创建覆盖卷。我不知道您的 HP PC 是否已配置这些。
There are some EWF system requirements listed here:
这里列出了一些 EWF 系统要求：
http://msdn.microsoft.com/en-ca/library/bb499124.aspx
http://msdn.microsoft.com/en-ca/library/bb499124.aspx
EWF usually creates its overlay volume during the First Boot Agent (FBA) process. You could check fbalog.txt for errors. There are some instructions for reconstructing an EWF volume here:
EWF 通常在 First Boot Agent (FBA) 过程中创建其覆盖卷。您可以检查 fbalog.txt 是否有错误。这里有一些重建 EWF 卷的说明：
http://msdn.microsoft.com/en-us/library/ms913271(WinEmbedded.5).aspx
http://msdn.microsoft.com/en-us/library/ms913271(WinEmbedded.5).aspx
The file not found error may be due to a missing ':' in your second command.
找不到文件错误可能是由于:您的第二个命令中缺少“ ”。
Try ewfmgr c: -enableinstead.
试试吧ewfmgr c: -enable。
回答by Daniel Knueven
I realize this question is old, but it came up in my search so I thought I would leave my answer.
我意识到这个问题很老，但它出现在我的搜索中，所以我想我会留下我的答案。
When I encountered this error it was because I had restored an image using imeagex. I didn't run sysprep before taking the backup image. I wiped and recreated the partition which updated the partition signature which confused EWF enough to make it not work.
当我遇到这个错误时，是因为我使用 imeagex 恢复了一个图像。在获取备份映像之前，我没有运行 sysprep。我擦除并重新创建了更新分区签名的分区，这足以混淆 EWF 使其无法工作。
EWF doesn't have a nice tool to configure the protected volumes. So I wrote one. Here's the source.
EWF 没有一个很好的工具来配置受保护的卷。所以我写了一篇。这是来源。
#define _WIN32_WINNT 0x0400
#include <windows.h>
#include <winioctl.h>
#include <tchar.h>
const TCHAR VOL_PATH[] = TEXT("SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume%i");
VOID Usage(){
_tprintf(TEXT("Usage: ewfvoladd <Drive Letter> <Volume Number>\n"));
}
INT _tmain(INT iArgCount, LPCTSTR pszArgVals[]){
INT iReturn = 0;
if (iArgCount == 3){
TCHAR szDrive[MAX_PATH];
_sntprintf_s(szDrive,MAX_PATH,TEXT("\\.\%s:"),pszArgVals[1]);
szDrive[MAX_PATH-1] = 0;
HANDLE hPartition = CreateFile(szDrive,GENERIC_READ,FILE_SHARE_READ | FILE_SHARE_WRITE,nullptr,OPEN_EXISTING,0,nullptr);
if (hPartition != INVALID_HANDLE_VALUE){
PARTITION_INFORMATION piPartInfo = {};
DWORD dwSize = sizeof(piPartInfo);
if (DeviceIoControl(hPartition,IOCTL_DISK_GET_PARTITION_INFO,nullptr,0,&piPartInfo,dwSize,&dwSize,nullptr)){
dwSize = sizeof(DRIVE_LAYOUT_INFORMATION) + sizeof(PARTITION_INFORMATION) * 9;
LPBYTE pbDrive = new BYTE [ dwSize ];
ZeroMemory(pbDrive,dwSize);
DRIVE_LAYOUT_INFORMATION *pdliDrive = (DRIVE_LAYOUT_INFORMATION*)pbDrive;
if (DeviceIoControl(hPartition,IOCTL_DISK_GET_DRIVE_LAYOUT,nullptr,0,pdliDrive,dwSize,&dwSize,nullptr)){
TCHAR szVol[MAX_PATH];
_sntprintf_s(szVol,MAX_PATH,VOL_PATH,(INT)_ttol(pszArgVals[2]));
szVol[MAX_PATH-1] = 0;
HKEY hVol = nullptr;
LONG lRegErr = RegCreateKeyEx(HKEY_LOCAL_MACHINE,szVol,0,nullptr,REG_OPTION_NON_VOLATILE,KEY_WRITE,nullptr,&hVol,nullptr);
if (lRegErr == ERROR_SUCCESS){
const DWORD dwZero = 0,
dwOne = 1,
dwTwo = 2;
lRegErr = RegSetValueEx(hVol,TEXT("Type"),0,REG_DWORD,(LPCBYTE)&dwTwo,sizeof(dwTwo));
if (lRegErr != ERROR_SUCCESS){
iReturn = (INT)lRegErr;
_tprintf(TEXT("Failed to set Type: %i\n"),iReturn);
}
lRegErr = RegSetValueEx(hVol,TEXT("Enabled"),0,REG_DWORD,(LPCBYTE)&dwZero,sizeof(dwZero));
if (lRegErr != ERROR_SUCCESS){
iReturn = (INT)lRegErr;
_tprintf(TEXT("Failed to set Enabled: %i\n"),iReturn);
}
lRegErr = RegSetValueEx(hVol,TEXT("CompareBeforeAlloc"),0,REG_DWORD,(LPCBYTE)&dwOne,sizeof(dwOne));
if (lRegErr != ERROR_SUCCESS){
iReturn = (INT)lRegErr;
_tprintf(TEXT("Failed to set CompareBeforeAlloc: %i\n"),iReturn);
}
lRegErr = RegSetValueEx(hVol,TEXT("DiskSignature"),0,REG_DWORD,(LPCBYTE)&pdliDrive->Signature,sizeof(pdliDrive->Signature));
if (lRegErr != ERROR_SUCCESS){
iReturn = (INT)lRegErr;
_tprintf(TEXT("Failed to set DiskSignature: %i\n"),iReturn);
}
lRegErr = RegSetValueEx(hVol,TEXT("PartitionOffset"),0,REG_QWORD,(LPCBYTE)&piPartInfo.StartingOffset.QuadPart,sizeof(piPartInfo.StartingOffset.QuadPart));
if (lRegErr != ERROR_SUCCESS){
iReturn = (INT)lRegErr;
_tprintf(TEXT("Failed to set PartitionOffset: %i\n"),iReturn);
}
RegCloseKey(hVol);
}else{
iReturn = (INT)lRegErr;
_tprintf(TEXT("Failed to open registry key (%s): %i\n"),szVol,iReturn);
}
}else{
iReturn = (INT)GetLastError();
_tprintf(TEXT("Failed to get disk info: %i\n"),iReturn);
}
delete [] pbDrive;
}else{
iReturn = (INT)GetLastError();
_tprintf(TEXT("Failed to get partition info: %i\n"),iReturn);
}
CloseHandle(hPartition);
}else{
iReturn = (INT)GetLastError();
_tprintf(TEXT("Failed to open drive: %i\n"),iReturn);
}
}else{
iReturn = ERROR_INVALID_PARAMETER;
Usage();
_tprintf(TEXT("\nNot enough parameters\n"));
}
return iReturn;
}
So, if you only have 1 partition and it's the C: drive you would run the following and reboot.
因此，如果您只有 1 个分区并且它是 C: 驱动器，您将运行以下命令并重新启动。
ewfvoladd c 0
Then you should be able to enable EWF like so
那么你应该能够像这样启用 EWF
ewfmgr c: -enable
Reboot again and you're done.
再次重启，你就完成了。
