有人把wes8的ewf提取出来在win8rp上使用成功的吗

2010gudam

有人把wes8的ewf提取出来在win8rp上使用成功的吗

11ydy

你遇到什么问题了么。

给你传个，复制文件，导入注册表，然后CMD执行命令ewfcfg -install
重启，就可以使用了

[ 本帖最后由 11ydy 于 2012-7-26 06:49 编辑 ]

嵐風

多數應該是reg的問題吧,付上我機子用的reg
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ewf]
"DisplayName"=""
"ErrorControl"=dword:00000003
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,\
  72,00,69,00,76,00,65,00,72,00,73,00,5c,00,65,00,77,00,66,00,2e,00,73,00,79,\
  00,73,00,00,00
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ewf\Parameters\Protected\Volume0]
"PartitionStyle"=dword:00000000
"DiskSignature"=dword:dce7b8bc
"PartitionOffset"=hex(b):00,00,10,00,00,00,00,00
"CompareBeforeAlloc"=dword:00000000
"Type"=dword:00000002
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ewf\Enum]
"0"="STORAGE\\Volume\\{6f87ff05-d319-11e1-a3d5-806e6f6e6963}#0000000000100000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

其中DiskSignature跟PartitionOffse要自己修改一下.方法如下:
系統管理員打開cmd
diskpart
LIST DISK
SELECT DISK 0
DETAIL DISK

DiskSignature=磁碟識別碼

LIST PARTITION
SELECT PARTITION 1
DETAIL PARTITION

PartitionOffset=位元組(diskpart顯示的是16進制,可以自行去regedit修正)

按自己要保護的磁碟跟分區select不同的,不一定是0跟1

嵐風

怕煩的可以直接用這個win7,忘了是誰寫的,但裝置管理員會多了個黃色的ewf裝置
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ewf]
"DisplayName"=""
"ErrorControl"=dword:00000003
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,\
  72,00,69,00,76,00,65,00,72,00,73,00,5c,00,65,00,77,00,66,00,2e,00,73,00,79,\
  00,73,00,00,00
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ewf\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000003
"NextInstance"=dword:00000003

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EWF]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EWF\0000]
"Service"="Ewf"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000400
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="Ewf"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EWF\0000\Control]
"ActiveService"="Ewf"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
"UpperFilters"="Ewf"

11ydy

原帖由 嵐風 于 2012-7-26 06:46 发表
其中DiskSignature跟PartitionOffse要自己修改一下.方法如下:
系統管理員打開cmd
diskpart
LIST DISK
SELECT DISK 0
DETAIL DISK

DiskSignature=磁碟識別碼

LIST PARTITION
SELECT PARTITION 1
DETAIL PARTITION

PartitionOffset=位元組(diskpart顯示的是16進制,可以自行去regedit修正)

按自己要保護的磁碟跟分區select不同的,不一定是0跟1
"Imag ...

这部分可以用ewfcfg -install代替，不过WES7 WES8中的 ewfcfg.exe不能正常使用，WES2011里面的可以使用

另外WIN8中启用EWF的注册表只要这些就够了
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ewf]
"DisplayName"=""
"ErrorControl"=dword:00000003
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,\
  72,00,69,00,76,00,65,00,72,00,73,00,5c,00,65,00,77,00,66,00,2e,00,73,00,79,\
  00,73,00,00,00
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}]

"LowerFilters"=hex(7):65,00,77,00,66,00,00,00,00,00

[ 本帖最后由 11ydy 于 2012-7-26 06:57 编辑 ]

2010gudam

thanks，测试一下看能不能 用，我用冰点还原把win8 rp保护起来用久了好像会出现系统错误，然后就永远进不去了

2010gudam

真的可以哦，请问一般从wes8中提取东西的步骤是怎样的？有这方面的教程吗

11ydy

WES的组件CAB包，里面的.manifest文件用记事本打开，可以看到这个组件包里文件及添加注册表项的信息

嵐風

我差點忘了diskpart那部分可以直接使用win7的ewfcfg