WinFE Dynamic Disk Problem

I'm finding that volumes on a dynamic disk are mounted and writeable.

Anybody else seeing this, and any possible solutions?

Thanks

Hi tbd879
can you give some more details so we can test.

is this VM or real hardware
Any other pertinant info would also be helpful.

Thanks in advance
RoyM

Hi RoyM,

There's not an awful lot more to add I found this on both VM and physical machines. The machines I tried all had a single dynamic disk, any volumes configured on the disks are online, drive letters assigned and writeable.

One test I performed was to boot a VM with a basic disk, confirmed that all worked as expected, then converted it to a dynamic disk. On the subsequent reboot the volumes appeared!

Thanks,
TBD

At it's bare minimum all the WinFE stuff relates to a couple keys in the Registry:
http://www.forensics....org/wiki/WinFE

Windows FE is based on the modification of just two entries in the Windows Registry. The first key is located at "HKEY_LOCAL_MACHINEsystemControlSet001ServicesMountMgr". The DWord "NoAutoMount" has to be set to "1". By doing this the Mount-Manager service will not automatically mount any storage device. The second key is "HKEY_LOCAL_MACHINEsystemControlSet001ServicespartmgrParameters" where "SanPolicy" has to be set to "3". While both keys will avoid the mounting of storage devices the user has to mount the storage drive manually by using the command-line tool DiskPart, while the evidence drive does not need to be mounted for imaging/forensic access.

So basically your report says that those keys do affect "basic disks" but NOT "dynamic disks".

Which services are in use on a "normal" (non WinFE) PE - booted from CD/DVD - when only a "basic disk" is connected?
Which services are in use on the SAME "normal" (non WinFE) PE when only a "dynamic disk" is connected?

Any difference?
Maybe taking a Regshot of the two runs and comparing them it is possible to find another service running.

This oldish KB:
http://support.micro...kb/234048/en-us
suggests that "LDM" (whatever it is) plays a role in letter assigning (and I presume - conversely - to their mounting).

A quick search in the Registry of an XP, shows:
HKEY_LOCAL_MACHINESYSTEMControlSet001ControlBackupRestoreKeysNotToRestore
LDM Boot Information=CurrentControlSetServicesdmioboot info
LDM Boot Information (dmboot)=CurrentControlSetServicesdmboot

and:
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEventlogSystemLDM
EventMessageFile=%SystemRoot%System32dmadmin.exe
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEventlogSystemLDMS
EventMessageFile=%SystemRoot%System32dmserver.dll

and:
HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSafeBootMinimaldmadmin
HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSafeBootMinimaldmserver
HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_DMADMIN0000
etc.

So I would check first thing for "anything" that is called dm* or dm*.*....
Check also this:
http://books.google....ic disk&f=false

It is very possible that another key is needed (or that *someone* must write a filter driver to avoid this kind of auto-mounting).


Wonko

Thanks for posting info tdb879.

Couldn't have said it better Wonko!
I'll check into it today and post back.

Thanks
RoyM

So basically your report says that those keys do affect "basic disks" but NOT "dynamic disks".

That does appear to be the case!

Thanks for the pointers, I'll see if I can dig up anything.

@tbd879,

I have developed a lite version of WinFE which uses my tool, but it is created from the Windows AIK and NOT WinBuilder, in this version, dynamic disks are not touched, it appears to be totally forensically sound, therefore, this error is something to do with how WinBuilder works or a subsequent script that is executed.

That makes solving the problem somewhat easier, I should have a solution to this all going well in about 2 weeks or so.

Colin.

Sorry about the raw formatting, but here is a list of files which only appear within the Winbuilder version, and not the Windows AIK built WinFE, any suggestions to which (if any) of these files may be causing the write issue on dynamic disks?

My next post will detail the files that only appear within the Windows AIK version of WinFE.

I have examined the SYSTEM hive and there is nothing obvious there apart from a few VSS entries.

.bootmgr
.program filesinternet explorerieproxy.dll
.program filesinternet explorerieshims.dll
.program filespeshellpeshell.exe
.program filespeshellpeshell.ini
.programdatamicrosoftuser account picturesuser.bmp
.programdatamicrosoftwindowsdevicemetadatastoreen-us34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms
.programdatamicrosoftwindowsdevicemetadatastoreen-us63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms
.usersdesktop.ini
.usersdefaultappdataroamingmicrosoftwindowslibrariesdesktop.ini
.usersdefaultappdataroamingmicrosoftwindowsstart menudesktop.ini
.usersdefaultappdataroamingmicrosoftwindowsstart menuprogramsdesktop.ini
.usersdefaultappdataroamingmicrosoftwindowsstart menuprogramsstartupdesktop.ini
.usersdefaultdocumentsdesktop.ini
.usersdefaultdownloadsdesktop.ini
.usersdefaultfavoritesdesktop.ini
.usersdefaultfavoriteswin7pe se msfn.url
.usersdefaultfavoriteswin7pe se reboot.url
.usersdefaultfavoriteswin7pe se the oven.url
.usersdefaultfavoriteslinksdesktop.ini
.usersdefaultlinksdesktop.ini
.usersdefaultmusicdesktop.ini
.usersdefaultpicturesdesktop.ini
.usersdefaultsaved gamesdesktop.ini
.usersdefaultvideosdesktop.ini
.windowsexplorer.exe
.windowsapppatchsysmain.sdb
.windowsbrandingbasebrdbasebrd.dll
.windowsbrandingbasebrden-usbasebrd.dll.mui
.windowsbrandingshellbrdshellbrd.dll
.windowsen-usexplorer.exe.mui
.windowsen-ushh.exe.mui
.windowsfontssimpbdo.ttf
.windowsservicingpackageswinpe-scripting-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-scripting-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingpackageswinpe-setup-client-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-setup-client-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingpackageswinpe-setup-client-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowsservicingpackageswinpe-setup-client-package~31bf3856ad364e35~x86~~6.1.7600.16385.mum
.windowsservicingpackageswinpe-setup-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-setup-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingpackageswinpe-setup-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowsservicingpackageswinpe-setup-package~31bf3856ad364e35~x86~~6.1.7600.16385.mum
.windowsservicingpackageswinpe-srt-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-srt-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingpackageswinpe-srt-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowsservicingpackageswinpe-srt-package~31bf3856ad364e35~x86~~6.1.7600.16385.mum
.windowsservicingpackageswinpe-wds-tools-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-wds-tools-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingpackageswinpe-wds-tools-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowsservicingpackageswinpe-wds-tools-package~31bf3856ad364e35~x86~~6.1.7600.16385.mum
.windowsservicingpackageswinpe-wmi-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-wmi-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingsessions13808_2866876144.back.xml
.windowsservicingsessions13808_2866876144.xml
.windowsservicingsessions14236_2866854023.back.xml
.windowsservicingsessions14236_2866854023.xml
.windowsservicingsessions22328_2866798674.back.xml
.windowsservicingsessions22328_2866798674.xml
.windowsservicingsessions23616_2866832947.back.xml
.windowsservicingsessions23616_2866832947.xml
.windowsservicingsessions27152_2866813275.back.xml
.windowsservicingsessions27152_2866813275.xml
.windowsservicingsessions27252_2866847174.back.xml
.windowsservicingsessions27252_2866847174.xml
.windowsservicingsessions28260_2867582547.back.xml
.windowsservicingsessions28260_2867582547.xml
.windowsservicingsessions30620_2867602001.back.xml
.windowsservicingsessions30620_2867602001.xml
.windowsservicingsessions3544_2867617632.back.xml
.windowsservicingsessions3544_2867617632.xml
.windowsservicingsessions5236_2866840482.back.xml
.windowsservicingsessions5236_2866840482.xml
.windowsservicingsessions5680_2866824039.back.xml
.windowsservicingsessions5680_2866824039.xml
.windowsservicingsessions6200_2867628053.back.xml
.windowsservicingsessions6200_2867628053.xml
.windowssystem32accessibilitycpl.dll
.windowssystem32actioncentercpl.dll
.windowssystem32actxprxy.dll
.windowssystem32adsldp.dll
.windowssystem32apphelp.dll
.windowssystem32appwiz.cpl
.windowssystem32au3361.exe
.windowssystem32autorun.cfg
.windowssystem32auxiliarydisplayapi.dll
.windowssystem32auxiliarydisplaycpl.dll
.windowssystem32avicap.dll
.windowssystem32avicap32.dll
.windowssystem32avifil32.dll
.windowssystem32avifile.dll
.windowssystem32avrt.dll
.windowssystem32axinstsv.dll
.windowssystem32biocpl.dll
.windowssystem32bmrui.exe
.windowssystem32bootrec.exe
.windowssystem32bthprops.cpl
.windowssystem32catsrv.dll
.windowssystem32catsrvps.dll
.windowssystem32catsrvut.dll
.windowssystem32cdusb.exe
.windowssystem32certenroll.dll
.windowssystem32clbcatq.dll
.windowssystem32colbact.dll
.windowssystem32collab.cpl
.windowssystem32comctl32.dll
.windowssystem32comm.drv
.windowssystem32comrepl.dll
.windowssystem32comsnap.dll
.windowssystem32comsvcs.dll
.windowssystem32comuid.dll
.windowssystem32control.exe
.windowssystem32corpol.dll
.windowssystem32crtdll.dll
.windowssystem32cscapi.dll
.windowssystem32cttune.exe
.windowssystem32d3d9.dll
.windowssystem32dcomcnfg.exe
.windowssystem32defaultlocationcpl.dll
.windowssystem32desk.cpl
.windowssystem32deskadp.dll
.windowssystem32deskmon.dll
.windowssystem32deskperf.dll
.windowssystem32desktop.ini
.windowssystem32devcon.exe
.windowssystem32devmgr.dll
.windowssystem32dhcpsapi.dll
.windowssystem32diagcpl.dll
.windowssystem32diskcopy.dll
.windowssystem32display.dll
.windowssystem32displayswitch.exe
.windowssystem32dmband.dll
.windowssystem32dmcompos.dll
.windowssystem32dmdlgs.dll
.windowssystem32dmdskmgr.dll
.windowssystem32dmdskres.dll
.windowssystem32dmdskres2.dll
.windowssystem32dmime.dll
.windowssystem32dmintf.dll
.windowssystem32dmloader.dll
.windowssystem32dmocx.dll
.windowssystem32dmscript.dll
.windowssystem32dmstyle.dll
.windowssystem32dmsynth.dll
.windowssystem32dmusic.dll
.windowssystem32dmvdsitf.dll
.windowssystem32dmview.ocx
.windowssystem32dsound.dll
.windowssystem32dwm.exe
.windowssystem32dwmredir.dll
.windowssystem32efsadu.dll
.windowssystem32es.dll
.windowssystem32eventcreate.exe
.windowssystem32eventvwr.exe
.windowssystem32firewall.cpl
.windowssystem32hdwwiz.cpl
.windowssystem32hdwwiz.exe
.windowssystem32hgcpl.dll
.windowssystem32hide.exe
.windowssystem32hiderun.exe
.windowssystem32hlink.dll
.windowssystem32hotplug.dll
.windowssystem32icacls.exe
.windowssystem32ie4uinit.exe
.windowssystem32ieakeng.dll
.windowssystem32ieaksie.dll
.windowssystem32ieakui.dll
.windowssystem32ieapfltr.dat
.windowssystem32ieapfltr.dll
.windowssystem32iedkcs32.dll
.windowssystem32iepeers.dll
.windowssystem32iernonce.dll
.windowssystem32iesetup.dll
.windowssystem32iesysprep.dll
.windowssystem32ieuinit.inf
.windowssystem32ieunatt.exe
.windowssystem32iexpress.exe
.windowssystem32inetcpl.cpl
.windowssystem32infocardcpl.cpl
.windowssystem32intl.cpl
.windowssystem32iologmsg.dll
.windowssystem32irprops.cpl
.windowssystem32iscsicpl.dll
.windowssystem32joy.cpl
.windowssystem32lpksetup.exe
.windowssystem32lpksetupproxyserv.dll
.windowssystem32main.cpl
.windowssystem32mdsched.exe
.windowssystem32mfcsubs.dll
.windowssystem32mmdevapi.dll
.windowssystem32mmsys.cpl
.windowssystem32msacm32.dll
.windowssystem32mscms.dll
.windowssystem32mscories.dll
.windowssystem32msfeeds.dll
.windowssystem32msfn_modrica.ico
.windowssystem32msi.dll
.windowssystem32msoert2.dll
.windowssystem32mstime.dll
.windowssystem32msvbvm60.dll
.windowssystem32msvcrt20.dll
.windowssystem32msvfw32.dll
.windowssystem32msvidc32.dll
.windowssystem32msvidctl.dll
.windowssystem32msvideo.dll
.windowssystem32mtstocom.exe
.windowssystem32mtxex.dll
.windowssystem32mtxlegih.dll
.windowssystem32ndfapi.dll
.windowssystem32netapi.dll
.windowssystem32netcenter.dll
.windowssystem32netcorehc.dll
.windowssystem32netdiagfx.dll
.windowssystem32netevent.dll
.windowssystem32netfxperf.dll
.windowssystem32netid.dll
.windowssystem32netplwiz.dll
.windowssystem32netprof.dll
.windowssystem32netprofm.dll
.windowssystem32netprojw.dll
.windowssystem32nettrace.dll
.windowssystem32networkexplorer.dll
.windowssystem32networkitemfactory.dll
.windowssystem32networkmap.dll
.windowssystem32objsel.dll
.windowssystem32occache.dll
.windowssystem32ole2.dll
.windowssystem32ole2disp.dll
.windowssystem32ole2nls.dll
.windowssystem32olecli.dll
.windowssystem32olecli32.dll
.windowssystem32oleprn.dll
.windowssystem32olesvr.dll
.windowssystem32olesvr32.dll
.windowssystem32olethk32.dll
.windowssystem32onlineidcpl.dll
.windowssystem32osbaseln.dll
.windowssystem32pdh.dll
.windowssystem32penet.exe
.windowssystem32perfcentercpl.dll
.windowssystem32pintool.exe
.windowssystem32pnpts.dll
.windowssystem32pnpunattend.exe
.windowssystem32pnputil.exe
.windowssystem32pnpxassoc.dll
.windowssystem32pnpxassocprx.dll
.windowssystem32powercfg.cpl
.windowssystem32powercpl.dll
.windowssystem32puiapi.dll
.windowssystem32quartz.dll
.windowssystem32query.dll
.windowssystem32reagent.dll
.windowssystem32reboot.ico
.windowssystem32recdisc.exe
.windowssystem32rshx32.dll
.windowssystem32rstrtmgr.dll
.windowssystem32rstrui.exe
.windowssystem32sdcpl.dll
.windowssystem32sens.dll
.windowssystem32sensorscpl.dll
.windowssystem32sharemediacpl.dll
.windowssystem32shdocvw.dll
.windowssystem32shellstyle.dll
.windowssystem32shfolder.dll
.windowssystem32shimgvw.dll
.windowssystem32shortcut.inf
.windowssystem32shortcuts.exe
.windowssystem32shpafact.dll
.windowssystem32shsvcs.dll
.windowssystem32shunimpl.dll
.windowssystem32shutdownpe.exe
.windowssystem32shutdownpe.ini
.windowssystem32shwebsvc.dll
.windowssystem32spehook.dll
.windowssystem32spp.dll
.windowssystem32srcore.dll
.windowssystem32srhelper.dll
.windowssystem32start.cmd
.windowssystem32stclient.dll
.windowssystem32sxproxy.dll
.windowssystem32sysdm.cpl
.windowssystem32systemcpl.dll
.windowssystem32systempropertiesadvanced.exe
.windowssystem32systempropertiescomputername.exe
.windowssystem32systempropertiesdataexecutionprevention.exe
.windowssystem32systempropertieshardware.exe
.windowssystem32systempropertiesperformance.exe
.windowssystem32systempropertiesprotection.exe
.windowssystem32systempropertiesremote.exe
.windowssystem32tabletpc.cpl
.windowssystem32taskbarcpl.dll
.windowssystem32telephon.cpl
.windowssystem32themecpl.dll
.windowssystem32themeui.dll
.windowssystem32spam.ico
.windowssystem32thumbcache.dll
.windowssystem32timedate.cpl
.windowssystem32tracerpt.exe
.windowssystem32tstheme.exe
.windowssystem32twext.dll
.windowssystem32txflog.dll
.windowssystem32uictl.exe
.windowssystem32user.exe
.windowssystem32usercpl.dll
.windowssystem32uxsms.dll
.windowssystem32van.dll
.windowssystem32vaultcli.dll
.windowssystem32verclsid.exe
.windowssystem32vssvc.exe
.windowssystem32wcspluginservice.dll
.windowssystem32wdi.dll
.windowssystem32wdscapture.exe
.windowssystem32wecapi.dll
.windowssystem32wecsvc.dll
.windowssystem32wecutil.exe
.windowssystem32wer.dll
.windowssystem32werconcpl.dll
.windowssystem32wermgr.exe
.windowssystem32werui.dll
.windowssystem32win7pe.cfg
.windowssystem32windowscodecsext.dll
.windowssystem32winrnr.dll
.windowssystem32wmdmlog.dll
.windowssystem32wmdmps.dll
.windowssystem32wmdrmdev.dll
.windowssystem32wmdrmnet.dll
.windowssystem32wmdrmsdk.dll
.windowssystem32wpccpl.dll
.windowssystem32wscui.cpl
.windowssystem32configsystemprofileappdataroamingmicrosoftinternet explorerquick launchshows desktop.lnk
.windowssystem32configsystemprofilelinksdocuments.lnk
.windowssystem32configsystemprofilelinksmusic.lnk
.windowssystem32configsystemprofilelinkspictures.lnk
.windowssystem32configsystemprofilelinksrecently changed.lnk
.windowssystem32configsystemprofilelinkssearches.lnk
.windowssystem32configsystemprofilesearcheseverywhere.search-ms
.windowssystem32configsystemprofilesearchesindexed locations.search-ms
.windowssystem32configsystemprofilesearchesrecent documents.search-ms
.windowssystem32configsystemprofilesearchesrecent e-mail.search-ms
.windowssystem32configsystemprofilesearchesrecent music.search-ms
.windowssystem32configsystemprofilesearchesrecent pictures and videos.search-ms
.windowssystem32configsystemprofilesearchesrecently changed.search-ms
.windowssystem32configsystemprofilesearchesshared by me.search-ms

Windows AIK builf WinFE files only.

.windowsbootfontswgl4_boot.ttf
.windowsbootpcatbootmgr
.windowsbootpcatmemtest.exe
.windowsbootpcatcs-czbootmgr.exe.mui
.windowsbootpcatda-dkbootmgr.exe.mui
.windowsbootpcatde-debootmgr.exe.mui
.windowsbootpcatel-grbootmgr.exe.mui
.windowsbootpcaten-usbootmgr.exe.mui
.windowsbootpcaten-usmemtest.exe.mui
.windowsbootpcates-esbootmgr.exe.mui
.windowsbootpcatfi-fibootmgr.exe.mui
.windowsbootpcatfr-frbootmgr.exe.mui
.windowsbootpcathu-hubootmgr.exe.mui
.windowsbootpcatit-itbootmgr.exe.mui
.windowsbootpcatja-jpbootmgr.exe.mui
.windowsbootpcatko-krbootmgr.exe.mui
.windowsbootpcatnb-nobootmgr.exe.mui
.windowsbootpcatnl-nlbootmgr.exe.mui
.windowsbootpcatpl-plbootmgr.exe.mui
.windowsbootpcatpt-brbootmgr.exe.mui
.windowsbootpcatpt-ptbootmgr.exe.mui
.windowsbootpcatru-rubootmgr.exe.mui
.windowsbootpcatsv-sebootmgr.exe.mui
.windowsbootpcattr-trbootmgr.exe.mui
.windowsbootpcatzh-cnbootmgr.exe.mui
.windowsbootpcatzh-hkbootmgr.exe.mui
.windowsbootpcatzh-twbootmgr.exe.mui
.windowsbootpxeabortpxe.com
.windowsbootpxebootmgr.exe
.windowsbootpxehdlscom1.com
.windowsbootpxehdlscom1.n12
.windowsbootpxehdlscom2.com
.windowsbootpxehdlscom2.n12
.windowsbootpxepxeboot.com
.windowsbootpxepxeboot.n12
.windowsbootpxewdsconfig.inf
.windowsbootpxewdsnbp.com
.windowsbootpxecs-czbootmgr.exe.mui
.windowsbootpxeda-dkbootmgr.exe.mui
.windowsbootpxede-debootmgr.exe.mui
.windowsbootpxeel-grbootmgr.exe.mui
.windowsbootpxeen-usbootmgr.exe.mui
.windowsbootpxees-esbootmgr.exe.mui
.windowsbootpxefi-fibootmgr.exe.mui
.windowsbootpxefr-frbootmgr.exe.mui
.windowsbootpxehu-hubootmgr.exe.mui
.windowsbootpxeit-itbootmgr.exe.mui
.windowsbootpxeja-jpbootmgr.exe.mui
.windowsbootpxeko-krbootmgr.exe.mui
.windowsbootpxenb-nobootmgr.exe.mui
.windowsbootpxenl-nlbootmgr.exe.mui
.windowsbootpxepl-plbootmgr.exe.mui
.windowsbootpxept-brbootmgr.exe.mui
.windowsbootpxept-ptbootmgr.exe.mui
.windowsbootpxeru-rubootmgr.exe.mui
.windowsbootpxesv-sebootmgr.exe.mui
.windowsbootpxetr-trbootmgr.exe.mui
.windowsbootpxezh-cnbootmgr.exe.mui
.windowsbootpxezh-hkbootmgr.exe.mui
.windowsbootpxezh-twbootmgr.exe.mui
.windowsinfoem0.inf
.windowsinfoem1.inf
.windowsinfoem2.inf
.windowsinfoem3.inf
.windowsinfoem4.inf
.windowsschemaseaphostbaseeapconnectionpropertiesv1.xsd
.windowsschemaseaphostbaseeapmethodconfig.xsd
.windowsschemaseaphostbaseeapmethodusercredentials.xsd
.windowsschemaseaphostbaseeapuserpropertiesv1.xsd
.windowsschemaseaphosteapcommon.xsd
.windowsschemaseaphosteapconnectionpropertiesv1.xsd
.windowsschemaseaphosteapgenericusercredentials.xsd
.windowsschemaseaphosteaphostconfig.xsd
.windowsschemaseaphosteaphostusercredentials.xsd
.windowsschemaseaphosteapuserpropertiesv1.xsd
.windowsservicingpackageswinpe-hta-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowsservicingpackageswinpe-hta-package~31bf3856ad364e35~x86~~6.1.7600.16385.mum
.windowsservicingsessions3136_3239703.back.xml
.windowsservicingsessions3136_3239703.xml
.windowsservicingsessions3748_3202279.back.xml
.windowsservicingsessions3748_3202279.xml
.windowsservicingsessions796_3247254.back.xml
.windowsservicingsessions796_3247254.xml
.windowssystem32activeds.dll
.windowssystem32activeds.tlb
.windowssystem32adsldpc.dll
.windowssystem32akshhl27.dll
.windowssystem32akshsp51.dll
.windowssystem32aksllmtp.exe
.windowssystem32aksusb3.dll
.windowssystem32apds.dll
.windowssystem32apircl.dll
.windowssystem32apss.dll
.windowssystem32asycfilt.dll
.windowssystem32atmfd.dll
.windowssystem32batt.dll
.windowssystem32bthci.dll
.windowssystem32bthserv.dll
.windowssystem32c_g18030.dll
.windowssystem32c_is2022.dll
.windowssystem32calc.exe
.windowssystem32capisp.dll
.windowssystem32cmifw.dll
.windowssystem32cnvfat.dll
.windowssystem32dciman32.dll
.windowssystem32defragproxy.dll
.windowssystem32dispci.dll
.windowssystem32dispex.dll
.windowssystem32dpx.dll
.windowssystem32dskquota.dll
.windowssystem32dwmcore.dll
.windowssystem32eapp3hst.dll
.windowssystem32eappcfg.dll
.windowssystem32eappgnui.dll
.windowssystem32eapphost.dll
.windowssystem32eappprxy.dll
.windowssystem32eapqec.dll
.windowssystem32efscore.dll
.windowssystem32efslsaext.dll
.windowssystem32eventcls.dll
.windowssystem32explorer.exe
.windowssystem32f3ahvoas.dll
.windowssystem32fbwflib.dll
.windowssystem32fmifs.dll
.windowssystem32fontsub.dll
.windowssystem32framedyn.dll
.windowssystem32fveapi.dll
.windowssystem32fveapibase.dll
.windowssystem32fvecerts.dll
.windowssystem32fverecover.dll
.windowssystem32fveui.dll
.windowssystem32fvewiz.dll
.windowssystem32fwremotesvr.dll
.windowssystem32gacinstall.dll
.windowssystem32hhsetup.dll
.windowssystem32hid.dll
.windowssystem32hidserv.dll
.windowssystem32httpapi.dll
.windowssystem32iccoinstall.dll
.windowssystem32icfupgd.dll
.windowssystem32icmp.dll
.windowssystem32icrav03.rat
.windowssystem32idndl.dll
.windowssystem32ifmon.dll
.windowssystem32ifsutil.dll
.windowssystem32ifsutilx.dll
.windowssystem32ikeext.dll
.windowssystem32inetmib1.dll
.windowssystem32inetres.dll
.windowssystem32iscsilog.dll
.windowssystem32kd1394.dll
.windowssystem32kdusb.dll
.windowssystem32keyiso.dll
.windowssystem32kmddsp.tsp
.windowssystem32loadperf.dll
.windowssystem32luainstall.dll
.windowssystem32mag_hook.dll
.windowssystem32magnify.exe
.windowssystem32manage-bde.wsf
.windowssystem32mapi32.dll
.windowssystem32mapistub.dll
.windowssystem32mcupdate_authenticamd.dll
.windowssystem32mcupdate_genuineintel.dll
.windowssystem32mf3216.dll
.windowssystem32mfc42.dll
.windowssystem32mfc42u.dll
.windowssystem32microsoft-windows-hal-events.dll
.windowssystem32microsoft-windows-kernel-power-events.dll
.windowssystem32microsoft-windows-kernel-processor-power-events.dll
.windowssystem32mlang.dat
.windowssystem32mlang.dll
.windowssystem32msafd.dll
.windowssystem32mscat32.dll
.windowssystem32mscpxl32.dll
.windowssystem32msdelta.dll
.windowssystem32mshta.exe
.windowssystem32mshtml.tlb
.windowssystem32mshtmled.dll
.windowssystem32msiltcfg.dll
.windowssystem32msimtf.dll
.windowssystem32msmmsp.dll
.windowssystem32mspaint.exe
.windowssystem32mspatcha.dll
.windowssystem32msports.dll
.windowssystem32mssip32.dll
.windowssystem32msswch.dll
.windowssystem32mstsc.exe
.windowssystem32mstscax.dll
.windowssystem32muifontsetup.dll
.windowssystem32ncryptui.dll
.windowssystem32ncsi.dll
.windowssystem32ndptsp.tsp
.windowssystem32nlsdl.dll
.windowssystem32nshwfp.dll
.windowssystem32ntprint.dll
.windowssystem32osk.exe
.windowssystem32osuninst.dll
.windowssystem32perfctrs.dll
.windowssystem32perfdisk.dll
.windowssystem32perfnet.dll
.windowssystem32perfos.dll
.windowssystem32perfproc.dll
.windowssystem32pngfilt.dll
.windowssystem32pnidui.dll
.windowssystem32polstore.dll
.windowssystem32prflbmsg.dll
.windowssystem32rasctrnm.h
.windowssystem32rasmbmgr.dll
.windowssystem32softpub.dll
.windowssystem32sppinst.dll
.windowssystem32ticrf.rat
.windowssystem32tzres.dll
.windowssystem32umpo.dll
.windowssystem32ureg.dll
.windowssystem32utildll.dll
.windowssystem32uudf.dll
.windowssystem32uxinit.dll
.windowssystem32verifier.dll
.windowssystem32vga.dll
.windowssystem32vga256.dll
.windowssystem32vga64k.dll
.windowssystem32vmbuscoinstaller.dll
.windowssystem32vmbuspipe.dll
.windowssystem32vmbusres.dll
.windowssystem32vmdcoinstall.dll
.windowssystem32vmicres.dll
.windowssystem32vmictimeprovider.dll
.windowssystem32vmstorfltres.dll
.windowssystem32vpnike.dll
.windowssystem32wbiosrvc.dll
.windowssystem32wfapigp.dll
.windowssystem32winbio.dll
.windowssystem32winfelite.exe
.windowssystem32winpe.bmp
.windowssystem32winscard.dll
.windowssystem32winsockhc.dll
.windowssystem32wlanutil.dll
.windowssystem32wmi.dll
.windowssystem32wmicmiplugin.dll
.windowssystem32wmiprop.dll
.windowssystem32ws2help.dll
.windowssystem32wshcon.dll
.windowssystem32advancedinstallerscmiadapter.dll
.windowssystem32advancedinstallerscmitrust.dll
.windowssystem32advancedinstallerscmiv2.dll
.windowssystem32advancedinstallerscntrtextinstaller.dll
.windowssystem32advancedinstallerslocdrv.dll
.windowssystem32advancedinstallersoemhelpins.dll
.windowssystem32ar-sacdosys.dll.mui
.windowssystem32ar-sacomctl32.dll.mui
.windowssystem32ar-sacomdlg32.dll.mui
.windowssystem32ar-safms.dll.mui
.windowssystem32ar-samlang.dll.mui
.windowssystem32ar-samsimsg.dll.mui
.windowssystem32ar-samsprivs.dll.mui
.windowssystem32bg-bgcomctl32.dll.mui
.windowssystem32bg-bgcomdlg32.dll.mui
.windowssystem32bg-bgfms.dll.mui
.windowssystem32bg-bgmlang.dll.mui
.windowssystem32bg-bgmsimsg.dll.mui
.windowssystem32bootwinresume.exe
.windowssystem32booten-uswinresume.exe.mui
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-hyper-v-winpe-drivers-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-client-wired-network-drivers-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-client-wired-network-drivers-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-common-drivers-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-common-drivers-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-server-wired-network-drivers-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-server-wired-network-drivers-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-winpe-drivers-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-winpe-drivers-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-winpe-languagepack-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-winpe-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}nt5.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}ntexe.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}ntpe.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}ntph.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}oem0.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}oem1.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}oem2.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}oem3.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}winpe-hta-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}winpe-scripting-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}winpe-wmi-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32codeintegritydriver.stl
.windowssystem32configbcd-template
.windowssystem32configcomponents.log
.windowssystem32configcomponents{6cced2bf-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configcomponents{6cced2bf-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configcomponents{6cced2bf-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configdefault.log
.windowssystem32configdefault{6cced2bb-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configdefault{6cced2bb-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configdefault{6cced2bb-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsam.log1
.windowssystem32configsam.log2
.windowssystem32configsam{6cced2c7-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsam{6cced2c7-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsam{6cced2c7-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsam{6cced3b4-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsam{6cced3b4-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsam{6cced3b4-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsecurity.log
.windowssystem32configsecurity.log1
.windowssystem32configsecurity.log2
.windowssystem32configsecurity{6cced2cb-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsecurity{6cced2cb-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsecurity{6cced2cb-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsecurity{6cced3ae-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsecurity{6cced3ae-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsecurity{6cced3ae-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsoftware.log
.windowssystem32configsoftware{6cced2cf-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsoftware{6cced2cf-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsoftware{6cced2cf-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsystem.log
.windowssystem32configsystem{6cced2d3-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsystem{6cced2d3-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsystem{6cced2d3-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32cs-czcdosys.dll.mui
.windowssystem32cs-czcomctl32.dll.mui
.windowssystem32cs-czcomdlg32.dll.mui
.windowssystem32cs-czfms.dll.mui
.windowssystem32cs-czmlang.dll.mui
.windowssystem32cs-czmsimsg.dll.mui
.windowssystem32cs-czmsprivs.dll.mui
.windowssystem32da-dkcdosys.dll.mui
.windowssystem32da-dkcomctl32.dll.mui
.windowssystem32da-dkcomdlg32.dll.mui
.windowssystem32da-dkfms.dll.mui
.windowssystem32da-dkmlang.dll.mui
.windowssystem32da-dkmsimsg.dll.mui
.windowssystem32da-dkmsprivs.dll.mui
.windowssystem32de-decdosys.dll.mui
.windowssystem32de-decomctl32.dll.mui
.windowssystem32de-decomdlg32.dll.mui
.windowssystem32de-defms.dll.mui
.windowssystem32de-demlang.dll.mui
.windowssystem32de-demsimsg.dll.mui
.windowssystem32de-demsprivs.dll.mui

I have applied some changes to the WinFE WinBuilder write protect script to attempt to address the 'Dynamic Disk' issue, if there are any volunteers, the script can be found here:

www.ramsdens.org.uk

If possible, could I have feedback as simply getting no feedback tells me nothing!

The Lite (non WinBuilder) version of WinFE is also available on this page, it is more intended for imaging (and possibly, Triage tasks too).

Thanks in advance,

Colin.

I have applied some changes to the WinFE WinBuilder write protect script to attempt to address the 'Dynamic Disk' issue, if there are any volunteers, the script can be found here:

www.ramsdens.org.uk

If possible, could I have feedback as simply getting no feedback tells me nothing!

The Lite (non WinBuilder) version of WinFE is also available on this page, it is more intended for imaging (and possibly, Triage tasks too).

Thanks in advance,


Colin.

Hi,

Disabling volmgrx seems to have done the trick - thank you! One thing I hadn't made clear was that I encountered the problem with an AIK build not using winbuilder, so not sure why you didn't see it there. Anyway, thanks for this and all your other work with WinFE.