Re: Corruption even with EWF on?

Hi Desi,

You should use "ewfmgr c: -commitanddisable" when using EWF RAM REG. "-live"
switch is only for EWF RAM.

When it comes to the application error I don´t know what happened, but I
really hope that it is caused by the unprotected queue files (or I could be
in big trouble myself)....
Otherwise, as you mentioned, what´s the point of EWF in the first place...
....

BR,
Rob

"Desi" <richardsd@xxxxxxxxxxxxxxxxxxx> skrev i meddelandet
news:1127915215.232742.307200@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
> Hello all,
>
> I have an image that uses EWF RAM REG protection to protect Drive C:.
> There are two additional volumes, D: and E: that are not protected.
>
> C: and E: share the same physical drive.
>
> While testing at my desk, I would allow the system to boot fully into
> Windows XPe and sit at the logon prompt. Once it had stabilized, I
> would pull the power cord and allow the machine to reboot.
>
> This worked well for 20-30 times, and then the next time it came up I
> received the error:
>
> mqsvc.eve - Application Error
>
> The exception Breakpoint
> A breakpoint has been reached.
> (0x80000003) occurred in the application at location 0x00000000.
>
> Click OK to terminate the application.
>
> [OK Button]
>
>
> MSMQ seems to be the culprit, and I am using a released, runtime
> version of the MSMQ binaries. My queue files are on D: - Could they
> have been corrupted and start causing this error?
>
> Also, I cannot seem to turn off the EWF now that it's on. If I do a
> "ewfmgr c: -disable", the status shows DISABLE as the boot command, but
> when it reboots EWF is still turned on and enabled. I tried "ewfmgr c:
> -commitanddisable -live", and it does not disable it. I have updated to
> the post-SP2 patched version of EWF.
>
> I don't understand the inner workings of the EWF filter as well as some
> of the experts in here - Can anyone shed some light on what might have
> occurred?
>
> As it stands right now, EWF doesn't hold much value if the system can
> still be crashed by sudden power loss...
>


.