FIX: Some Enhanced Write Filter commands and some switches for the Ewfmgr.exe program do not work correctly (823025)


The information in this article applies to:

  • Microsoft Windows XP Embedded

SYMPTOMS

When you use Enhanced Write Filter (EWF) on a Microsoft Windows XP Embedded Service Pack 1 (SP1) run time, and when you control EWF through either the EWF API or the Ewfmgr.exe program, you may experience any one of the following symptoms:
  • The /nocmd switch for the Ewfmgr.exe program does not work correctly.
  • The /commitanddisable switch for the Ewfmgr.exe program does not work correctly for RAM-based overlays.
  • The /commitanddisable switch and the /nocmd switch for the Ewfmgr.exe program do not work for RAM-Registry-based overlays.
  • Status information for RAM-based overlays is not returned through the EWF API.
  • The EwfMgrRegisterLowSpaceNotification() function does not work correctly if the low space threshold is passed before the function call is made.

CAUSE

These problems are caused by bugs in the Enhanced Write Filter component.

RESOLUTION

A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Only apply it to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Service Pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

http://support.microsoft.com/contactus/?ws=support

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
   Date         Time    Version      Size             File name
   ----------------------------------------------------------------
   12-Jun-2003  17:05   2.0.1901.0   35,200 bytes     Ewf.sys

Enhancements

The following information describes the original behavior before the hotfix and the enhanced behavior after the hotfix.

The /nocmd switch clears the boot command

  • Original - When you run the Ewfmgr.exe program and you include the /nocmd switch, the boot command is not cleared.
  • Enhanced - The /nocmd switch for the Ewfmgr.exe program correctly clears the boot command.

The /commitanddisable switch sets the boot command to Disable

  • Original - When you run the Ewfmgr.exe program and you include the /commitanddisable switch on a system that uses RAM-based overlays, the overlay is not committed and the boot command is not set to Disable.
  • Enhanced - The /commitanddisable switch for the Ewfmgr.exe program correctly commits a RAM-based overlay, and the boot command is set to Disable.

The switches handle the boot command correctly

  • Original - When you run the Ewfmgr.exe program and you include either the /commitanddisable switch or the /nocmd switch (or both switches) on a system that uses RAM-Registry-based overlays, the overlay is not committed, and the boot command is handled as follows:
    • The boot command is not set to Disable by the /commitanddisable switch.
    • The boot command is not cleared by the /nocmd switch.
  • Enhanced - The /commitanddisable switch correctly commits the RAM-Registry-based overlay and sets the boot command to Disable, and the /nocmd switch correctly clears the boot command.

The EwfMgrGetProtectedVolumeConfig() function returns correct status information

  • Original - When you use the EwfMgrGetProtectedVolumeConfig() function to retrieve the current status of the EWF overlay, an incorrect status may be returned for RAM-based overlays. The status that is returned does not accurately reflect the effect of issuing a clear command or a commit command on the overlay.
  • Enhanced - The EwfMgrGetProtectedVolumeConfig() function returns accurate status information about the volume. This status information is reported after all the commands that are issued on the overlay.

The EwfMgrRegisterLowSpaceNotification() function fires correctly

  • Original - The EwfMgrRegisterLowSpaceNotification() function permits you to set a notification event to fire when the free space in the overlay reaches a specific low space threshold. If the free space in the overlay is already larger than the value of the low space threshold that you set by using the EwfMgrRegisterLowSpaceNotification() function, the event never fires. For example, an event does not fire if the free space in the overlay is only 25 megabytes (MB), even though you set a value for the low space threshold of 30 MB.
  • Enhanced - The EwfMgrRegisterLowSpaceNotification() function fires correctly when the free space of the overlay exceeds the value of the low space threshold when the value is set.

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

MORE INFORMATION

For more information about Enhanced Write Filter, see the Windows XP Embedded Help files, or visit the following Microsoft Web site:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/html/xeconenhancedwritefilter.asp

To download Windows XP Embedded hotfixes, visit the following Microsoft MSDN Web site:

http://www.microsoft.com/embedded

For additional information about various software updates, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Modification Type:MinorLast Reviewed:4/6/2006
Keywords:kbfix kbprb kbBug kbQFE KB823025 kbAudDeveloper kbAudOEM
©2004 Microsoft Corporation. All rights reserved.