A simple guide for implementing EWF (RAM-Reg Mode)

1. Get the files

Download Windows XP Embedded Service Pack 2 Feature Pack 2007 from here:

http://www.microsoft.com/downloads/details.aspx?FamilyID=9bdf1dea-a37e-4d25-83df-aabbaa78914f&displaylang=en

Mount image (i. e. Nero ImageDrive) and open XPEFP2007.EXE using an archive manager (i. e. WinRAR). In the 'rep' directory you'll find this files: ewf.sys and ewfmgr.exe. Extract them.

2. Copy files

ewfmgr.exe -> \windows\system32
ewf.sys -> \windows\system32\drivers

3. Update Windows Registry

You will need to create several keys and values:

Key name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf

Name: ErrorControl
Type: REG_DWORD
Value: 0x00000001 (1)

Name: Group
Type: REG_SZ
Value: System Bus Extender

Name: Start
Type: REG_DWORD
Value: 0x00000000 (0)

Name: Type
Type: REG_DWORD
Value: 0x00000001 (1)

Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0

Name: Enabled
Type: REG_DWORD
Value: 0

Name: Type
Type: REG_DWORD
Value: 0x00000001 (1)

Name: ArcName
Type: REG_SZ
Value: multi(0)disk(0)rdisk(0)partition(1)

Key Name: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}

Name: UpperFilters
Type: REG_MULTI_SZ
Value: EWF (if the value of this key is volsnap, add EWF to the value on a new line)

More information here: http://msdn.microsoft.com/en-us/library/ms940182.aspx
Also, I've found this interesting blog: http://granturing.blogspot.com/