EWF disable/deactivate problem 

EWF writefilter. And I guess the EWF writefilter is configured in RAMREG mode on your WES7 target machine.

1. To check the state of EWF writefilter use the command “ewfmgr /all”

2. To disable EWF (RAMREG mode) use the command “ewfmgr c: -commitanddisable”

 

 

EWF –  for xp  is installed   on windows 7   , after some commands , bluescreen + no way to boot up the pc

 

safe mode – bluescreen

last good known configuration – bluescreen

normal startup – bluescreen

 

The Solution for me  was :

 

 

LIVE  CD  (wix xp or 7 or linux)

To Restore your old registry go to

C:\Windows\System32\config\RegBack

And copy from there

SOFTWARE

Sam

SYSTEM

 

TO

C:\Windows\System32\config\

 

REBOOT. Ok