有人把wes8的ewf提取出来在win8rp上使用成功的吗

嵐風

多數應該是reg的問題吧,付上我機子用的reg
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ewf]
"DisplayName"=""
"ErrorControl"=dword:00000003
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,\
  72,00,69,00,76,00,65,00,72,00,73,00,5c,00,65,00,77,00,66,00,2e,00,73,00,79,\
  00,73,00,00,00
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ewf\Parameters\Protected\Volume0]
"PartitionStyle"=dword:00000000
"DiskSignature"=dword:dce7b8bc
"PartitionOffset"=hex(b):00,00,10,00,00,00,00,00
"CompareBeforeAlloc"=dword:00000000
"Type"=dword:00000002
"Enabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ewf\Enum]
"0"="STORAGE\\Volume\\{6f87ff05-d319-11e1-a3d5-806e6f6e6963}#0000000000100000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

其中DiskSignature跟PartitionOffse要自己修改一下.方法如下:
系統管理員打開cmd
diskpart
LIST DISK
SELECT DISK 0
DETAIL DISK

DiskSignature=磁碟識別碼

LIST PARTITION
SELECT PARTITION 1
DETAIL PARTITION

PartitionOffset=位元組(diskpart顯示的是16進制,可以自行去regedit修正)

按自己要保護的磁碟跟分區select不同的,不一定是0跟1

嵐風

怕煩的可以直接用這個win7,忘了是誰寫的,但裝置管理員會多了個黃色的ewf裝置
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ewf]
"DisplayName"=""
"ErrorControl"=dword:00000003
"ImagePath"=hex(2):73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,\
  72,00,69,00,76,00,65,00,72,00,73,00,5c,00,65,00,77,00,66,00,2e,00,73,00,79,\
  00,73,00,00,00
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Ewf\Enum]
"0"="Root\\LEGACY_EWF\\0000"
"Count"=dword:00000003
"NextInstance"=dword:00000003

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EWF]
"NextInstance"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EWF\0000]
"Service"="Ewf"
"Legacy"=dword:00000001
"ConfigFlags"=dword:00000400
"Class"="LegacyDriver"
"ClassGUID"="{8ECC055D-047F-11D1-A537-0000F8753ED1}"
"DeviceDesc"="Ewf"
"Capabilities"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_EWF\0000\Control]
"ActiveService"="Ewf"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
"UpperFilters"="Ewf"

嵐風

我差點忘了diskpart那部分可以直接使用win7的ewfcfg