Enhanced Write Filter (EWF)

在已经装好的XPE中添加Enhanced Write Filter (EWF)功能 1.把文件ntldr 拷到 C:\ ，覆盖了原来的ntldr。 2.拷贝文件ewfmgr.exe 到 C:\windows\system32 3.拷贝文件ewfapi.dll、ewfdll.dll、ewfinit.dll 到 C:\windows\system32 (如何文件已存在，则不进行文件覆盖) 4.拷贝文件ewf.sys 到 C:\windows\system32\drivers (如何文件已存在，则不进行文件覆盖) 5.导入注册表Regedit.reg。如果导入不成功，说明权限不够，运行REGEDIT，在HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root上点右键，添加EVERYONE为完全控制，再导入，如果权限赋予，则可忽略错误 6.在XPE中导入上面做好的注册表文件(Regedit.reg)，重新启动计算机 7.在XPE的CMD中运行以下命令：rundll32 ewfdll.dll,ConfigureEwf 8.重新启动计算机 9.重启计算机后，在XPE的CMD中运行：ewfmgr c: -enable 启用C盘的保护,重新动计算 10.重启计算机后，在XPE的CMD中运行：ewfmgr c: 检查EWF的状态是否正常 使用说明 1.启用C盘的保护：ewfmgr c: -enable 2.关闭C盘的保护：ewfmgr c: -commitanddisable 3.检查C盘的EWF的状态：ewfmgr c: 所有操作需要重启后生效 *************************************************************注意事项********************************************* 1.CF卡分区：在安装系统时将系统占用的磁盘空间减小1005m(默认的是全部CF卡容量)，即可预留出1005m的未指派分区 2.C盘分区后面建立一个未分配磁盘分区，分区大小应该和你注册表设置的一致。注意，这个分区应该存在于C盘和D盘之间，如果创建在所有分区的最后面，可能会出错，只是可能。 3.修改注册文件中 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\FBA] "DiskSig"=dword:4f544c45 "OVSize"=dword:000f55c8 ----> 应该是1005m 这里设置你的未分配分区的大小 **********************************************************注册文件说明(Disk硬盘版)****************************************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction] "Enable"="N" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout] "EnableAutoLayout"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem] "NtfsDisableLastAccessUpdate"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters] "EnablePrefetcher"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager] BootExecute="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF] "NextInstance"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000] "Service"="EWF" "Legacy"=dword:00000001 "ConfigFlags"=dword:00000020 "Class"="LegacyDriver" "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}" "DeviceDesc"="EWF" "Capabilities"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000\Control] "ActiveService"="EWF" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\FBA] "DiskSig"=dword:4f544c45 "OVSize"=dword:000f55c8 ----> 应该是1005m 这里设置你的未分配分区的大小 "OVLevel"=dword:00000001 "PVConfigs"=dword:00000001 "EwfEnable"=hex(7):30,00,00,00,00,00 "EnableLazyWrite"=hex(7):30,00,00,00,00,00 "PVDisk"=hex(7):30,00,00,00,00,00 "PVPart"=hex(7):31,00,00,00,00,00 "PVDiskType"=hex(7):30,00,00,00,00,00 "PVType"=hex(7):30,00,00,00,00,00 ---〉30 为disk ,31 为ram "PVOptimize"=hex(7):32,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0] "ArcName"="multi(0)disk(0)rdisk(0)partition(1)" "ClumpSize"=dword:00000200 "Type"=dword:00000000 ----〉0为disk 1 为 ram "Enabled"=dword:00000001 "VolumeID"="{CCE9E3DA-1B74-43db-910A-9D58FACF88FE}" --->这个要加上 可以用GUIDGEN产生一个来 **********************************************************注册文件说明(RAM内存版)********************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction] "Enable"="N" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OptimalLayout] "EnableAutoLayout"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem] "NtfsDisableLastAccessUpdate"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters] "EnablePrefetcher"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager] BootExecute="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF] "NextInstance"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000] "Service"="EWF" "Legacy"=dword:00000001 "ConfigFlags"=dword:00000020 "Class"="LegacyDriver" "ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}" "DeviceDesc"="EWF" "Capabilities"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_EWF\0000\Control] "ActiveService"="EWF" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\FBA] "DiskSig"=dword:4f544c45 "OVSize"=dword:000f55c8 "OVLevel"=dword:00000001 "PVConfigs"=dword:00000001 "EwfEnable"=hex(7):30,00,00,00,00,00 "EnableLazyWrite"=hex(7):30,00,00,00,00,00 "PVDisk"=hex(7):30,00,00,00,00,00 "PVPart"=hex(7):31,00,00,00,00,00 "PVDiskType"=hex(7):30,00,00,00,00,00 "PVType"=hex(7):30,00,00,00,00,00 "PVOptimize"=hex(7):32,00,00,00,00,00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\Volume0] "ArcName"="multi(0)disk(0)rdisk(0)partition(1)" "ClumpSize"=dword:00000200 "Type"=dword:00000000 "Enabled"=dword:00000001 "VolumeID"="{CCE9E3DA-1B74-43db-910A-9D58FACF88FE}"