I have been working with Windows Embedded Standard 7 (WES7) for quite a while for various projects. In most configurations, the WES7 resides on a SD card with Enhanced Write Filter turned on for System partition. In order to clone the SD cards with the system image, I do sector by sector copy and everything works on the cloned SD card.

However at one point, I had to do setup WES7 on Hard disk and image it. Now when I cloned the hard disk image to other hard disks, the Enhanced Write Filter wouldn’t work on the cloned Hard disks. When I issued the following ewfmgr command

– ewfmgr c:

I would get the following result:
– Failed getting protected volume configuration with error 1.

I tried various cloning software utilities without any success. After hours of troubleshooting, the solution that worked for me was to go to the following registry key:
– HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services
\Ewf\Parameters\Protected\Volume0

and change the value of DiskSignature to the disk signature of the disk running WES7.

Missing [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ services\Ewf\Parameters] key

In another case, after deploying fresh WIM image of WES7, I didn’t get the [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Ewf\Parameters] key to begin with. In this case I exported the key from another WES 7 installation and imported it in the new installation. Following are the contents of the exported .reg file.

[text wraplines=”true”]
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
services\Ewf\Parameters\Protected\Volume0]
“DiskSignature”=dword:326b0b32
“PartitionOffset”=hex(b):00,00,10,00,00,00,00,00
“CompareBeforeAlloc”=dword:00000000
“Type”=dword:00000002
“Enabled”=dword:00000000
[/text]

After importing the key, I fixed the disk signature, restarted the WES7 system and found EWF to be working.