I have been working with Windows Embedded Standard 7 (WES7) for quite a while for various projects. In most configurations, the WES7 resides on a SD card with Enhanced Write Filter turned on for System partition. In order to clone the SD cards with the system image, I do sector by sector copy and everything works on the cloned SD card.
However at one point, I had to do setup WES7 on Hard disk and image it. Now when I cloned the hard disk image to other hard disks, the Enhanced Write Filter wouldn’t work on the cloned Hard disks. When I issued the following ewfmgr command
– ewfmgr c:
I would get the following result:
– Failed getting protected volume configuration with error 1.
I tried various cloning software utilities without any success. After hours of troubleshooting, the solution that worked for me was to go to the following registry key:
and change the value of DiskSignature to the disk signature of the disk running WES7.
Missing [HKEY_LOCAL_MACHINESYSTEMCurrentControlSet servicesEwfParameters] key
In another case, after deploying fresh WIM image of WES7, I didn’t get the [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesEwfParameters] key to begin with. In this case I exported the key from another WES 7 installation and imported it in the new installation. Following are the contents of the exported .reg file.
Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINESYSTEMCurrentControlSet servicesEwfParameters] [HKEY_LOCAL_MACHINESYSTEMCurrentControlSet servicesEwfParametersProtected] [HKEY_LOCAL_MACHINESYSTEMCurrentControlSet servicesEwfParametersProtectedVolume0] "DiskSignature"=dword:326b0b32 "PartitionOffset"=hex(b):00,00,10,00,00,00,00,00 "CompareBeforeAlloc"=dword:00000000 "Type"=dword:00000002 "Enabled"=dword:00000000
After importing the key, I fixed the disk signature, restarted the WES7 system and found EWF to be working.