A simple guide for implementing EWF (RAM-Reg Mode)
1. Get the filesDownload Windows XP Embedded Service Pack 2 Feature Pack 2007 from here:
http://www.microsoft.com/downloads/details.aspx?FamilyID=9bdf1dea-a37e-4d25-83df-aabbaa78914f&displaylang=enMount image (i. e. Nero ImageDrive) and open XPEFP2007.EXE using an archive manager (i. e. WinRAR). In the 'rep' directory you'll find this files:
ewf.sys and
ewfmgr.exe. Extract them.
2. Copy filesewfmgr.exe -> \windows\system32
ewf.sys -> \windows\system32\drivers
3. Update Windows RegistryYou will need to create several keys and values:
Key name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf Name: ErrorControl
Type: REG_DWORD
Value: 0x00000001 (1)
Name: Group
Type: REG_SZ
Value: System Bus Extender
Name: Start
Type: REG_DWORD
Value: 0x00000000 (0)
Name: Type
Type: REG_DWORD
Value: 0x00000001 (1)
Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0 Name: Enabled
Type: REG_DWORD
Value: 0
Name: Type
Type: REG_DWORD
Value: 0x00000001 (1)
Name: ArcName
Type: REG_SZ
Value: multi(0)disk(0)rdisk(0)partition(1)
Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}Name: UpperFilters
Type: REG_MULTI_SZ
Value: EWF (if the value of this key is volsnap, add EWF to the value on a new line)
More information here:
http://msdn.microsoft.com/en-us/library/ms940182.aspxAlso, I've found this interesting blog:
http://granturing.blogspot.com/Regards,