Protect Multiple Volumes By Using RAM Reg Mode (Standard 7 SP1)
7/8/2014
You can extend EWF RAM Reg overlays to protect multiple volumes on a device by setting RAM Reg mode for each volume you want to protect.
To protect multiple volumes by using RAM Reg mode
Follow the procedure in Configure EWF RAM Reg Mode.
Expand the Embedded Enabling Features node in the answer file pane then select Enhanced Write Filter with HORM. The EWF configuration settings appear in the settings pane
Change the following default settings for Enhanced Write Filter:
- In the Filter view by box, select 4 Specialize.
- In the EWFMode box, select RamReg.
- Identify all volumes you want to protect using the ProtectedVolumes property of the Enhanced Write Filter with HORM component.
Notes
Note
When protecting multiple volumes using EWF Ram Reg mode, you only have to commit the overlay to the partition where the Registry is stored. For example, if you had two protected partitions, C: and D:, you would use the EWF Manager command to disable the overlay on D:, and then commit the changes to the registry on C:.
ewfmgr d: -disable
ewfmgr c: -commit
Important
You must reboot the system in this scenario because the overlay is written to the protected volume on the next system restart.