Jump to content











Photo

WinFE Dynamic Disk Problem


  • Please log in to reply
10 replies to this topic

#1 tbd879

tbd879
  • Members
  • 7 posts
  •  
    United Kingdom

Posted 24 November 2011 - 03:44 PM

I'm finding that volumes on a dynamic disk are mounted and writeable.

Anybody else seeing this, and any possible solutions?

Thanks

#2 RoyM

RoyM

    Frequent Member

  • .script developer
  • 358 posts
  • Interests:Component level repair, Micro-processor based equipment. Computer Repair + Custom Builds.
    (ie. Game Machines, Custom Firewalls\Smoothwalls)
    Network Penetration and testing, Including Wireless.
    Fishing, Hunting, Camping, Gaming.
  •  
    United States

Posted 27 November 2011 - 01:09 AM

Hi tbd879
can you give some more details so we can test.

is this VM or real hardware
Any other pertinant info would also be helpful.

Thanks in advance
RoyM

#3 tbd879

tbd879
  • Members
  • 7 posts
  •  
    United Kingdom

Posted 28 November 2011 - 09:28 AM

Hi RoyM,

There's not an awful lot more to add :) I found this on both VM and physical machines. The machines I tried all had a single dynamic disk, any volumes configured on the disks are online, drive letters assigned and writeable.

One test I performed was to boot a VM with a basic disk, confirmed that all worked as expected, then converted it to a dynamic disk. On the subsequent reboot the volumes appeared!

Thanks,
TBD

#4 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 10,813 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 28 November 2011 - 10:28 AM

At it's bare minimum all the WinFE stuff relates to a couple keys in the Registry:
http://www.forensics....org/wiki/WinFE

Windows FE is based on the modification of just two entries in the Windows Registry. The first key is located at "HKEY_LOCAL_MACHINEsystemControlSet001ServicesMountMgr". The DWord "NoAutoMount" has to be set to "1". By doing this the Mount-Manager service will not automatically mount any storage device. The second key is "HKEY_LOCAL_MACHINEsystemControlSet001ServicespartmgrParameters" where "SanPolicy" has to be set to "3". While both keys will avoid the mounting of storage devices the user has to mount the storage drive manually by using the command-line tool DiskPart, while the evidence drive does not need to be mounted for imaging/forensic access.


So basically your report says that those keys do affect "basic disks" but NOT "dynamic disks".

Which services are in use on a "normal" (non WinFE) PE - booted from CD/DVD - when only a "basic disk" is connected?
Which services are in use on the SAME "normal" (non WinFE) PE when only a "dynamic disk" is connected?

Any difference?
Maybe taking a Regshot of the two runs and comparing them it is possible to find another service running. :unsure:

This oldish KB:
http://support.micro...kb/234048/en-us
suggests that "LDM" (whatever it is) plays a role in letter assigning (and I presume - conversely - to their mounting).

A quick search in the Registry of an XP, shows:
HKEY_LOCAL_MACHINESYSTEMControlSet001ControlBackupRestoreKeysNotToRestore
LDM Boot Information=CurrentControlSetServicesdmioboot info
LDM Boot Information (dmboot)=CurrentControlSetServicesdmboot

and:
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEventlogSystemLDM
EventMessageFile=%SystemRoot%System32dmadmin.exe
HKEY_LOCAL_MACHINESYSTEMControlSet001ServicesEventlogSystemLDMS
EventMessageFile=%SystemRoot%System32dmserver.dll

and:
HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSafeBootMinimaldmadmin
HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSafeBootMinimaldmserver
HKEY_LOCAL_MACHINESYSTEMControlSet001EnumRootLEGACY_DMADMIN0000
etc.

So I would check first thing for "anything" that is called dm* or dm*.*....
Check also this:
http://books.google....ic disk&f=false

It is very possible that another key is needed (or that *someone* must write a filter driver to avoid this kind of auto-mounting). :dubbio:

:cheers:
Wonko
  • Nuno Brito likes this

#5 RoyM

RoyM

    Frequent Member

  • .script developer
  • 358 posts
  • Interests:Component level repair, Micro-processor based equipment. Computer Repair + Custom Builds.
    (ie. Game Machines, Custom Firewalls\Smoothwalls)
    Network Penetration and testing, Including Wireless.
    Fishing, Hunting, Camping, Gaming.
  •  
    United States

Posted 28 November 2011 - 02:27 PM

Thanks for posting info tdb879.

Couldn't have said it better Wonko!
I'll check into it today and post back.

Thanks
RoyM

#6 tbd879

tbd879
  • Members
  • 7 posts
  •  
    United Kingdom

Posted 29 November 2011 - 09:23 AM

So basically your report says that those keys do affect "basic disks" but NOT "dynamic disks".

That does appear to be the case!

Thanks for the pointers, I'll see if I can dig up anything.

#7 cramsden

cramsden

    Member

  • Members
  • 43 posts
  •  
    United Kingdom

Posted 30 March 2012 - 10:22 PM

@tbd879,

I have developed a lite version of WinFE which uses my tool, but it is created from the Windows AIK and NOT WinBuilder, in this version, dynamic disks are not touched, it appears to be totally forensically sound, therefore, this error is something to do with how WinBuilder works or a subsequent script that is executed.

That makes solving the problem somewhat easier, I should have a solution to this all going well in about 2 weeks or so.

Colin.

#8 cramsden

cramsden

    Member

  • Members
  • 43 posts
  •  
    United Kingdom

Posted 05 April 2012 - 07:55 PM

Sorry about the raw formatting, but here is a list of files which only appear within the Winbuilder version, and not the Windows AIK built WinFE, any suggestions to which (if any) of these files may be causing the write issue on dynamic disks?

My next post will detail the files that only appear within the Windows AIK version of WinFE.

I have examined the SYSTEM hive and there is nothing obvious there apart from a few VSS entries.

.bootmgr
.program filesinternet explorerieproxy.dll
.program filesinternet explorerieshims.dll
.program filespeshellpeshell.exe
.program filespeshellpeshell.ini
.programdatamicrosoftuser account picturesuser.bmp
.programdatamicrosoftwindowsdevicemetadatastoreen-us34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms
.programdatamicrosoftwindowsdevicemetadatastoreen-us63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms
.usersdesktop.ini
.usersdefaultappdataroamingmicrosoftwindowslibrariesdesktop.ini
.usersdefaultappdataroamingmicrosoftwindowsstart menudesktop.ini
.usersdefaultappdataroamingmicrosoftwindowsstart menuprogramsdesktop.ini
.usersdefaultappdataroamingmicrosoftwindowsstart menuprogramsstartupdesktop.ini
.usersdefaultdocumentsdesktop.ini
.usersdefaultdownloadsdesktop.ini
.usersdefaultfavoritesdesktop.ini
.usersdefaultfavoriteswin7pe se msfn.url
.usersdefaultfavoriteswin7pe se reboot.url
.usersdefaultfavoriteswin7pe se the oven.url
.usersdefaultfavoriteslinksdesktop.ini
.usersdefaultlinksdesktop.ini
.usersdefaultmusicdesktop.ini
.usersdefaultpicturesdesktop.ini
.usersdefaultsaved gamesdesktop.ini
.usersdefaultvideosdesktop.ini
.windowsexplorer.exe
.windowsapppatchsysmain.sdb
.windowsbrandingbasebrdbasebrd.dll
.windowsbrandingbasebrden-usbasebrd.dll.mui
.windowsbrandingshellbrdshellbrd.dll
.windowsen-usexplorer.exe.mui
.windowsen-ushh.exe.mui
.windowsfontssimpbdo.ttf
.windowsservicingpackageswinpe-scripting-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-scripting-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingpackageswinpe-setup-client-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-setup-client-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingpackageswinpe-setup-client-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowsservicingpackageswinpe-setup-client-package~31bf3856ad364e35~x86~~6.1.7600.16385.mum
.windowsservicingpackageswinpe-setup-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-setup-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingpackageswinpe-setup-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowsservicingpackageswinpe-setup-package~31bf3856ad364e35~x86~~6.1.7600.16385.mum
.windowsservicingpackageswinpe-srt-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-srt-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingpackageswinpe-srt-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowsservicingpackageswinpe-srt-package~31bf3856ad364e35~x86~~6.1.7600.16385.mum
.windowsservicingpackageswinpe-wds-tools-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-wds-tools-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingpackageswinpe-wds-tools-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowsservicingpackageswinpe-wds-tools-package~31bf3856ad364e35~x86~~6.1.7600.16385.mum
.windowsservicingpackageswinpe-wmi-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowsservicingpackageswinpe-wmi-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.mum
.windowsservicingsessions13808_2866876144.back.xml
.windowsservicingsessions13808_2866876144.xml
.windowsservicingsessions14236_2866854023.back.xml
.windowsservicingsessions14236_2866854023.xml
.windowsservicingsessions22328_2866798674.back.xml
.windowsservicingsessions22328_2866798674.xml
.windowsservicingsessions23616_2866832947.back.xml
.windowsservicingsessions23616_2866832947.xml
.windowsservicingsessions27152_2866813275.back.xml
.windowsservicingsessions27152_2866813275.xml
.windowsservicingsessions27252_2866847174.back.xml
.windowsservicingsessions27252_2866847174.xml
.windowsservicingsessions28260_2867582547.back.xml
.windowsservicingsessions28260_2867582547.xml
.windowsservicingsessions30620_2867602001.back.xml
.windowsservicingsessions30620_2867602001.xml
.windowsservicingsessions3544_2867617632.back.xml
.windowsservicingsessions3544_2867617632.xml
.windowsservicingsessions5236_2866840482.back.xml
.windowsservicingsessions5236_2866840482.xml
.windowsservicingsessions5680_2866824039.back.xml
.windowsservicingsessions5680_2866824039.xml
.windowsservicingsessions6200_2867628053.back.xml
.windowsservicingsessions6200_2867628053.xml
.windowssystem32accessibilitycpl.dll
.windowssystem32actioncentercpl.dll
.windowssystem32actxprxy.dll
.windowssystem32adsldp.dll
.windowssystem32apphelp.dll
.windowssystem32appwiz.cpl
.windowssystem32au3361.exe
.windowssystem32autorun.cfg
.windowssystem32auxiliarydisplayapi.dll
.windowssystem32auxiliarydisplaycpl.dll
.windowssystem32avicap.dll
.windowssystem32avicap32.dll
.windowssystem32avifil32.dll
.windowssystem32avifile.dll
.windowssystem32avrt.dll
.windowssystem32axinstsv.dll
.windowssystem32biocpl.dll
.windowssystem32bmrui.exe
.windowssystem32bootrec.exe
.windowssystem32bthprops.cpl
.windowssystem32catsrv.dll
.windowssystem32catsrvps.dll
.windowssystem32catsrvut.dll
.windowssystem32cdusb.exe
.windowssystem32certenroll.dll
.windowssystem32clbcatq.dll
.windowssystem32colbact.dll
.windowssystem32collab.cpl
.windowssystem32comctl32.dll
.windowssystem32comm.drv
.windowssystem32comrepl.dll
.windowssystem32comsnap.dll
.windowssystem32comsvcs.dll
.windowssystem32comuid.dll
.windowssystem32control.exe
.windowssystem32corpol.dll
.windowssystem32crtdll.dll
.windowssystem32cscapi.dll
.windowssystem32cttune.exe
.windowssystem32d3d9.dll
.windowssystem32dcomcnfg.exe
.windowssystem32defaultlocationcpl.dll
.windowssystem32desk.cpl
.windowssystem32deskadp.dll
.windowssystem32deskmon.dll
.windowssystem32deskperf.dll
.windowssystem32desktop.ini
.windowssystem32devcon.exe
.windowssystem32devmgr.dll
.windowssystem32dhcpsapi.dll
.windowssystem32diagcpl.dll
.windowssystem32diskcopy.dll
.windowssystem32display.dll
.windowssystem32displayswitch.exe
.windowssystem32dmband.dll
.windowssystem32dmcompos.dll
.windowssystem32dmdlgs.dll
.windowssystem32dmdskmgr.dll
.windowssystem32dmdskres.dll
.windowssystem32dmdskres2.dll
.windowssystem32dmime.dll
.windowssystem32dmintf.dll
.windowssystem32dmloader.dll
.windowssystem32dmocx.dll
.windowssystem32dmscript.dll
.windowssystem32dmstyle.dll
.windowssystem32dmsynth.dll
.windowssystem32dmusic.dll
.windowssystem32dmvdsitf.dll
.windowssystem32dmview.ocx
.windowssystem32dsound.dll
.windowssystem32dwm.exe
.windowssystem32dwmredir.dll
.windowssystem32efsadu.dll
.windowssystem32es.dll
.windowssystem32eventcreate.exe
.windowssystem32eventvwr.exe
.windowssystem32firewall.cpl
.windowssystem32hdwwiz.cpl
.windowssystem32hdwwiz.exe
.windowssystem32hgcpl.dll
.windowssystem32hide.exe
.windowssystem32hiderun.exe
.windowssystem32hlink.dll
.windowssystem32hotplug.dll
.windowssystem32icacls.exe
.windowssystem32ie4uinit.exe
.windowssystem32ieakeng.dll
.windowssystem32ieaksie.dll
.windowssystem32ieakui.dll
.windowssystem32ieapfltr.dat
.windowssystem32ieapfltr.dll
.windowssystem32iedkcs32.dll
.windowssystem32iepeers.dll
.windowssystem32iernonce.dll
.windowssystem32iesetup.dll
.windowssystem32iesysprep.dll
.windowssystem32ieuinit.inf
.windowssystem32ieunatt.exe
.windowssystem32iexpress.exe
.windowssystem32inetcpl.cpl
.windowssystem32infocardcpl.cpl
.windowssystem32intl.cpl
.windowssystem32iologmsg.dll
.windowssystem32irprops.cpl
.windowssystem32iscsicpl.dll
.windowssystem32joy.cpl
.windowssystem32lpksetup.exe
.windowssystem32lpksetupproxyserv.dll
.windowssystem32main.cpl
.windowssystem32mdsched.exe
.windowssystem32mfcsubs.dll
.windowssystem32mmdevapi.dll
.windowssystem32mmsys.cpl
.windowssystem32msacm32.dll
.windowssystem32mscms.dll
.windowssystem32mscories.dll
.windowssystem32msfeeds.dll
.windowssystem32msfn_modrica.ico
.windowssystem32msi.dll
.windowssystem32msoert2.dll
.windowssystem32mstime.dll
.windowssystem32msvbvm60.dll
.windowssystem32msvcrt20.dll
.windowssystem32msvfw32.dll
.windowssystem32msvidc32.dll
.windowssystem32msvidctl.dll
.windowssystem32msvideo.dll
.windowssystem32mtstocom.exe
.windowssystem32mtxex.dll
.windowssystem32mtxlegih.dll
.windowssystem32ndfapi.dll
.windowssystem32netapi.dll
.windowssystem32netcenter.dll
.windowssystem32netcorehc.dll
.windowssystem32netdiagfx.dll
.windowssystem32netevent.dll
.windowssystem32netfxperf.dll
.windowssystem32netid.dll
.windowssystem32netplwiz.dll
.windowssystem32netprof.dll
.windowssystem32netprofm.dll
.windowssystem32netprojw.dll
.windowssystem32nettrace.dll
.windowssystem32networkexplorer.dll
.windowssystem32networkitemfactory.dll
.windowssystem32networkmap.dll
.windowssystem32objsel.dll
.windowssystem32occache.dll
.windowssystem32ole2.dll
.windowssystem32ole2disp.dll
.windowssystem32ole2nls.dll
.windowssystem32olecli.dll
.windowssystem32olecli32.dll
.windowssystem32oleprn.dll
.windowssystem32olesvr.dll
.windowssystem32olesvr32.dll
.windowssystem32olethk32.dll
.windowssystem32onlineidcpl.dll
.windowssystem32osbaseln.dll
.windowssystem32pdh.dll
.windowssystem32penet.exe
.windowssystem32perfcentercpl.dll
.windowssystem32pintool.exe
.windowssystem32pnpts.dll
.windowssystem32pnpunattend.exe
.windowssystem32pnputil.exe
.windowssystem32pnpxassoc.dll
.windowssystem32pnpxassocprx.dll
.windowssystem32powercfg.cpl
.windowssystem32powercpl.dll
.windowssystem32puiapi.dll
.windowssystem32quartz.dll
.windowssystem32query.dll
.windowssystem32reagent.dll
.windowssystem32reboot.ico
.windowssystem32recdisc.exe
.windowssystem32rshx32.dll
.windowssystem32rstrtmgr.dll
.windowssystem32rstrui.exe
.windowssystem32sdcpl.dll
.windowssystem32sens.dll
.windowssystem32sensorscpl.dll
.windowssystem32sharemediacpl.dll
.windowssystem32shdocvw.dll
.windowssystem32shellstyle.dll
.windowssystem32shfolder.dll
.windowssystem32shimgvw.dll
.windowssystem32shortcut.inf
.windowssystem32shortcuts.exe
.windowssystem32shpafact.dll
.windowssystem32shsvcs.dll
.windowssystem32shunimpl.dll
.windowssystem32shutdownpe.exe
.windowssystem32shutdownpe.ini
.windowssystem32shwebsvc.dll
.windowssystem32spehook.dll
.windowssystem32spp.dll
.windowssystem32srcore.dll
.windowssystem32srhelper.dll
.windowssystem32start.cmd
.windowssystem32stclient.dll
.windowssystem32sxproxy.dll
.windowssystem32sysdm.cpl
.windowssystem32systemcpl.dll
.windowssystem32systempropertiesadvanced.exe
.windowssystem32systempropertiescomputername.exe
.windowssystem32systempropertiesdataexecutionprevention.exe
.windowssystem32systempropertieshardware.exe
.windowssystem32systempropertiesperformance.exe
.windowssystem32systempropertiesprotection.exe
.windowssystem32systempropertiesremote.exe
.windowssystem32tabletpc.cpl
.windowssystem32taskbarcpl.dll
.windowssystem32telephon.cpl
.windowssystem32themecpl.dll
.windowssystem32themeui.dll
.windowssystem32spam.ico
.windowssystem32thumbcache.dll
.windowssystem32timedate.cpl
.windowssystem32tracerpt.exe
.windowssystem32tstheme.exe
.windowssystem32twext.dll
.windowssystem32txflog.dll
.windowssystem32uictl.exe
.windowssystem32user.exe
.windowssystem32usercpl.dll
.windowssystem32uxsms.dll
.windowssystem32van.dll
.windowssystem32vaultcli.dll
.windowssystem32verclsid.exe
.windowssystem32vssvc.exe
.windowssystem32wcspluginservice.dll
.windowssystem32wdi.dll
.windowssystem32wdscapture.exe
.windowssystem32wecapi.dll
.windowssystem32wecsvc.dll
.windowssystem32wecutil.exe
.windowssystem32wer.dll
.windowssystem32werconcpl.dll
.windowssystem32wermgr.exe
.windowssystem32werui.dll
.windowssystem32win7pe.cfg
.windowssystem32windowscodecsext.dll
.windowssystem32winrnr.dll
.windowssystem32wmdmlog.dll
.windowssystem32wmdmps.dll
.windowssystem32wmdrmdev.dll
.windowssystem32wmdrmnet.dll
.windowssystem32wmdrmsdk.dll
.windowssystem32wpccpl.dll
.windowssystem32wscui.cpl
.windowssystem32configsystemprofileappdataroamingmicrosoftinternet explorerquick launchshows desktop.lnk
.windowssystem32configsystemprofilelinksdocuments.lnk
.windowssystem32configsystemprofilelinksmusic.lnk
.windowssystem32configsystemprofilelinkspictures.lnk
.windowssystem32configsystemprofilelinksrecently changed.lnk
.windowssystem32configsystemprofilelinkssearches.lnk
.windowssystem32configsystemprofilesearcheseverywhere.search-ms
.windowssystem32configsystemprofilesearchesindexed locations.search-ms
.windowssystem32configsystemprofilesearchesrecent documents.search-ms
.windowssystem32configsystemprofilesearchesrecent e-mail.search-ms
.windowssystem32configsystemprofilesearchesrecent music.search-ms
.windowssystem32configsystemprofilesearchesrecent pictures and videos.search-ms
.windowssystem32configsystemprofilesearchesrecently changed.search-ms
.windowssystem32configsystemprofilesearchesshared by me.search-ms

#9 cramsden

cramsden

    Member

  • Members
  • 43 posts
  •  
    United Kingdom

Posted 05 April 2012 - 07:59 PM

Windows AIK builf WinFE files only.

.windowsbootfontswgl4_boot.ttf
.windowsbootpcatbootmgr
.windowsbootpcatmemtest.exe
.windowsbootpcatcs-czbootmgr.exe.mui
.windowsbootpcatda-dkbootmgr.exe.mui
.windowsbootpcatde-debootmgr.exe.mui
.windowsbootpcatel-grbootmgr.exe.mui
.windowsbootpcaten-usbootmgr.exe.mui
.windowsbootpcaten-usmemtest.exe.mui
.windowsbootpcates-esbootmgr.exe.mui
.windowsbootpcatfi-fibootmgr.exe.mui
.windowsbootpcatfr-frbootmgr.exe.mui
.windowsbootpcathu-hubootmgr.exe.mui
.windowsbootpcatit-itbootmgr.exe.mui
.windowsbootpcatja-jpbootmgr.exe.mui
.windowsbootpcatko-krbootmgr.exe.mui
.windowsbootpcatnb-nobootmgr.exe.mui
.windowsbootpcatnl-nlbootmgr.exe.mui
.windowsbootpcatpl-plbootmgr.exe.mui
.windowsbootpcatpt-brbootmgr.exe.mui
.windowsbootpcatpt-ptbootmgr.exe.mui
.windowsbootpcatru-rubootmgr.exe.mui
.windowsbootpcatsv-sebootmgr.exe.mui
.windowsbootpcattr-trbootmgr.exe.mui
.windowsbootpcatzh-cnbootmgr.exe.mui
.windowsbootpcatzh-hkbootmgr.exe.mui
.windowsbootpcatzh-twbootmgr.exe.mui
.windowsbootpxeabortpxe.com
.windowsbootpxebootmgr.exe
.windowsbootpxehdlscom1.com
.windowsbootpxehdlscom1.n12
.windowsbootpxehdlscom2.com
.windowsbootpxehdlscom2.n12
.windowsbootpxepxeboot.com
.windowsbootpxepxeboot.n12
.windowsbootpxewdsconfig.inf
.windowsbootpxewdsnbp.com
.windowsbootpxecs-czbootmgr.exe.mui
.windowsbootpxeda-dkbootmgr.exe.mui
.windowsbootpxede-debootmgr.exe.mui
.windowsbootpxeel-grbootmgr.exe.mui
.windowsbootpxeen-usbootmgr.exe.mui
.windowsbootpxees-esbootmgr.exe.mui
.windowsbootpxefi-fibootmgr.exe.mui
.windowsbootpxefr-frbootmgr.exe.mui
.windowsbootpxehu-hubootmgr.exe.mui
.windowsbootpxeit-itbootmgr.exe.mui
.windowsbootpxeja-jpbootmgr.exe.mui
.windowsbootpxeko-krbootmgr.exe.mui
.windowsbootpxenb-nobootmgr.exe.mui
.windowsbootpxenl-nlbootmgr.exe.mui
.windowsbootpxepl-plbootmgr.exe.mui
.windowsbootpxept-brbootmgr.exe.mui
.windowsbootpxept-ptbootmgr.exe.mui
.windowsbootpxeru-rubootmgr.exe.mui
.windowsbootpxesv-sebootmgr.exe.mui
.windowsbootpxetr-trbootmgr.exe.mui
.windowsbootpxezh-cnbootmgr.exe.mui
.windowsbootpxezh-hkbootmgr.exe.mui
.windowsbootpxezh-twbootmgr.exe.mui
.windowsinfoem0.inf
.windowsinfoem1.inf
.windowsinfoem2.inf
.windowsinfoem3.inf
.windowsinfoem4.inf
.windowsschemaseaphostbaseeapconnectionpropertiesv1.xsd
.windowsschemaseaphostbaseeapmethodconfig.xsd
.windowsschemaseaphostbaseeapmethodusercredentials.xsd
.windowsschemaseaphostbaseeapuserpropertiesv1.xsd
.windowsschemaseaphosteapcommon.xsd
.windowsschemaseaphosteapconnectionpropertiesv1.xsd
.windowsschemaseaphosteapgenericusercredentials.xsd
.windowsschemaseaphosteaphostconfig.xsd
.windowsschemaseaphosteaphostusercredentials.xsd
.windowsschemaseaphosteapuserpropertiesv1.xsd
.windowsservicingpackageswinpe-hta-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowsservicingpackageswinpe-hta-package~31bf3856ad364e35~x86~~6.1.7600.16385.mum
.windowsservicingsessions3136_3239703.back.xml
.windowsservicingsessions3136_3239703.xml
.windowsservicingsessions3748_3202279.back.xml
.windowsservicingsessions3748_3202279.xml
.windowsservicingsessions796_3247254.back.xml
.windowsservicingsessions796_3247254.xml
.windowssystem32activeds.dll
.windowssystem32activeds.tlb
.windowssystem32adsldpc.dll
.windowssystem32akshhl27.dll
.windowssystem32akshsp51.dll
.windowssystem32aksllmtp.exe
.windowssystem32aksusb3.dll
.windowssystem32apds.dll
.windowssystem32apircl.dll
.windowssystem32apss.dll
.windowssystem32asycfilt.dll
.windowssystem32atmfd.dll
.windowssystem32batt.dll
.windowssystem32bthci.dll
.windowssystem32bthserv.dll
.windowssystem32c_g18030.dll
.windowssystem32c_is2022.dll
.windowssystem32calc.exe
.windowssystem32capisp.dll
.windowssystem32cmifw.dll
.windowssystem32cnvfat.dll
.windowssystem32dciman32.dll
.windowssystem32defragproxy.dll
.windowssystem32dispci.dll
.windowssystem32dispex.dll
.windowssystem32dpx.dll
.windowssystem32dskquota.dll
.windowssystem32dwmcore.dll
.windowssystem32eapp3hst.dll
.windowssystem32eappcfg.dll
.windowssystem32eappgnui.dll
.windowssystem32eapphost.dll
.windowssystem32eappprxy.dll
.windowssystem32eapqec.dll
.windowssystem32efscore.dll
.windowssystem32efslsaext.dll
.windowssystem32eventcls.dll
.windowssystem32explorer.exe
.windowssystem32f3ahvoas.dll
.windowssystem32fbwflib.dll
.windowssystem32fmifs.dll
.windowssystem32fontsub.dll
.windowssystem32framedyn.dll
.windowssystem32fveapi.dll
.windowssystem32fveapibase.dll
.windowssystem32fvecerts.dll
.windowssystem32fverecover.dll
.windowssystem32fveui.dll
.windowssystem32fvewiz.dll
.windowssystem32fwremotesvr.dll
.windowssystem32gacinstall.dll
.windowssystem32hhsetup.dll
.windowssystem32hid.dll
.windowssystem32hidserv.dll
.windowssystem32httpapi.dll
.windowssystem32iccoinstall.dll
.windowssystem32icfupgd.dll
.windowssystem32icmp.dll
.windowssystem32icrav03.rat
.windowssystem32idndl.dll
.windowssystem32ifmon.dll
.windowssystem32ifsutil.dll
.windowssystem32ifsutilx.dll
.windowssystem32ikeext.dll
.windowssystem32inetmib1.dll
.windowssystem32inetres.dll
.windowssystem32iscsilog.dll
.windowssystem32kd1394.dll
.windowssystem32kdusb.dll
.windowssystem32keyiso.dll
.windowssystem32kmddsp.tsp
.windowssystem32loadperf.dll
.windowssystem32luainstall.dll
.windowssystem32mag_hook.dll
.windowssystem32magnify.exe
.windowssystem32manage-bde.wsf
.windowssystem32mapi32.dll
.windowssystem32mapistub.dll
.windowssystem32mcupdate_authenticamd.dll
.windowssystem32mcupdate_genuineintel.dll
.windowssystem32mf3216.dll
.windowssystem32mfc42.dll
.windowssystem32mfc42u.dll
.windowssystem32microsoft-windows-hal-events.dll
.windowssystem32microsoft-windows-kernel-power-events.dll
.windowssystem32microsoft-windows-kernel-processor-power-events.dll
.windowssystem32mlang.dat
.windowssystem32mlang.dll
.windowssystem32msafd.dll
.windowssystem32mscat32.dll
.windowssystem32mscpxl32.dll
.windowssystem32msdelta.dll
.windowssystem32mshta.exe
.windowssystem32mshtml.tlb
.windowssystem32mshtmled.dll
.windowssystem32msiltcfg.dll
.windowssystem32msimtf.dll
.windowssystem32msmmsp.dll
.windowssystem32mspaint.exe
.windowssystem32mspatcha.dll
.windowssystem32msports.dll
.windowssystem32mssip32.dll
.windowssystem32msswch.dll
.windowssystem32mstsc.exe
.windowssystem32mstscax.dll
.windowssystem32muifontsetup.dll
.windowssystem32ncryptui.dll
.windowssystem32ncsi.dll
.windowssystem32ndptsp.tsp
.windowssystem32nlsdl.dll
.windowssystem32nshwfp.dll
.windowssystem32ntprint.dll
.windowssystem32osk.exe
.windowssystem32osuninst.dll
.windowssystem32perfctrs.dll
.windowssystem32perfdisk.dll
.windowssystem32perfnet.dll
.windowssystem32perfos.dll
.windowssystem32perfproc.dll
.windowssystem32pngfilt.dll
.windowssystem32pnidui.dll
.windowssystem32polstore.dll
.windowssystem32prflbmsg.dll
.windowssystem32rasctrnm.h
.windowssystem32rasmbmgr.dll
.windowssystem32softpub.dll
.windowssystem32sppinst.dll
.windowssystem32ticrf.rat
.windowssystem32tzres.dll
.windowssystem32umpo.dll
.windowssystem32ureg.dll
.windowssystem32utildll.dll
.windowssystem32uudf.dll
.windowssystem32uxinit.dll
.windowssystem32verifier.dll
.windowssystem32vga.dll
.windowssystem32vga256.dll
.windowssystem32vga64k.dll
.windowssystem32vmbuscoinstaller.dll
.windowssystem32vmbuspipe.dll
.windowssystem32vmbusres.dll
.windowssystem32vmdcoinstall.dll
.windowssystem32vmicres.dll
.windowssystem32vmictimeprovider.dll
.windowssystem32vmstorfltres.dll
.windowssystem32vpnike.dll
.windowssystem32wbiosrvc.dll
.windowssystem32wfapigp.dll
.windowssystem32winbio.dll
.windowssystem32winfelite.exe
.windowssystem32winpe.bmp
.windowssystem32winscard.dll
.windowssystem32winsockhc.dll
.windowssystem32wlanutil.dll
.windowssystem32wmi.dll
.windowssystem32wmicmiplugin.dll
.windowssystem32wmiprop.dll
.windowssystem32ws2help.dll
.windowssystem32wshcon.dll
.windowssystem32advancedinstallerscmiadapter.dll
.windowssystem32advancedinstallerscmitrust.dll
.windowssystem32advancedinstallerscmiv2.dll
.windowssystem32advancedinstallerscntrtextinstaller.dll
.windowssystem32advancedinstallerslocdrv.dll
.windowssystem32advancedinstallersoemhelpins.dll
.windowssystem32ar-sacdosys.dll.mui
.windowssystem32ar-sacomctl32.dll.mui
.windowssystem32ar-sacomdlg32.dll.mui
.windowssystem32ar-safms.dll.mui
.windowssystem32ar-samlang.dll.mui
.windowssystem32ar-samsimsg.dll.mui
.windowssystem32ar-samsprivs.dll.mui
.windowssystem32bg-bgcomctl32.dll.mui
.windowssystem32bg-bgcomdlg32.dll.mui
.windowssystem32bg-bgfms.dll.mui
.windowssystem32bg-bgmlang.dll.mui
.windowssystem32bg-bgmsimsg.dll.mui
.windowssystem32bootwinresume.exe
.windowssystem32booten-uswinresume.exe.mui
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-hyper-v-winpe-drivers-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-client-wired-network-drivers-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-client-wired-network-drivers-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-common-drivers-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-common-drivers-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-server-wired-network-drivers-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-server-wired-network-drivers-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-winpe-drivers-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-winpe-drivers-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-winpe-languagepack-package~31bf3856ad364e35~x86~en-us~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}microsoft-windows-winpe-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}nt5.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}ntexe.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}ntpe.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}ntph.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}oem0.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}oem1.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}oem2.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}oem3.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}winpe-hta-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}winpe-scripting-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32catroot{f750e6c3-38ee-11d1-85e5-00c04fc295ee}winpe-wmi-package~31bf3856ad364e35~x86~~6.1.7600.16385.cat
.windowssystem32codeintegritydriver.stl
.windowssystem32configbcd-template
.windowssystem32configcomponents.log
.windowssystem32configcomponents{6cced2bf-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configcomponents{6cced2bf-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configcomponents{6cced2bf-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configdefault.log
.windowssystem32configdefault{6cced2bb-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configdefault{6cced2bb-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configdefault{6cced2bb-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsam.log1
.windowssystem32configsam.log2
.windowssystem32configsam{6cced2c7-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsam{6cced2c7-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsam{6cced2c7-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsam{6cced3b4-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsam{6cced3b4-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsam{6cced3b4-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsecurity.log
.windowssystem32configsecurity.log1
.windowssystem32configsecurity.log2
.windowssystem32configsecurity{6cced2cb-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsecurity{6cced2cb-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsecurity{6cced2cb-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsecurity{6cced3ae-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsecurity{6cced3ae-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsecurity{6cced3ae-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsoftware.log
.windowssystem32configsoftware{6cced2cf-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsoftware{6cced2cf-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsoftware{6cced2cf-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32configsystem.log
.windowssystem32configsystem{6cced2d3-6e01-11de-8bed-001e0bcd1824}.tm.blf
.windowssystem32configsystem{6cced2d3-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000001.regtrans-ms
.windowssystem32configsystem{6cced2d3-6e01-11de-8bed-001e0bcd1824}.tmcontainer00000000000000000002.regtrans-ms
.windowssystem32cs-czcdosys.dll.mui
.windowssystem32cs-czcomctl32.dll.mui
.windowssystem32cs-czcomdlg32.dll.mui
.windowssystem32cs-czfms.dll.mui
.windowssystem32cs-czmlang.dll.mui
.windowssystem32cs-czmsimsg.dll.mui
.windowssystem32cs-czmsprivs.dll.mui
.windowssystem32da-dkcdosys.dll.mui
.windowssystem32da-dkcomctl32.dll.mui
.windowssystem32da-dkcomdlg32.dll.mui
.windowssystem32da-dkfms.dll.mui
.windowssystem32da-dkmlang.dll.mui
.windowssystem32da-dkmsimsg.dll.mui
.windowssystem32da-dkmsprivs.dll.mui
.windowssystem32de-decdosys.dll.mui
.windowssystem32de-decomctl32.dll.mui
.windowssystem32de-decomdlg32.dll.mui
.windowssystem32de-defms.dll.mui
.windowssystem32de-demlang.dll.mui
.windowssystem32de-demsimsg.dll.mui
.windowssystem32de-demsprivs.dll.mui

#10 cramsden

cramsden

    Member

  • Members
  • 43 posts
  •  
    United Kingdom

Posted 17 June 2012 - 12:22 PM

I have applied some changes to the WinFE WinBuilder write protect script to attempt to address the 'Dynamic Disk' issue, if there are any volunteers, the script can be found here:

www.ramsdens.org.uk

If possible, could I have feedback as simply getting no feedback tells me nothing!

The Lite (non WinBuilder) version of WinFE is also available on this page, it is more intended for imaging (and possibly, Triage tasks too).

Thanks in advance,

Colin.

#11 tbd879

tbd879
  • Members
  • 7 posts
  •  
    United Kingdom

Posted 19 June 2012 - 02:57 PM

I have applied some changes to the WinFE WinBuilder write protect script to attempt to address the 'Dynamic Disk' issue, if there are any volunteers, the script can be found here:

www.ramsdens.org.uk

If possible, could I have feedback as simply getting no feedback tells me nothing!

The Lite (non WinBuilder) version of WinFE is also available on this page, it is more intended for imaging (and possibly, Triage tasks too).

Thanks in advance,


Colin.


Hi,

Disabling volmgrx seems to have done the trick - thank you! One thing I hadn't made clear was that I encountered the problem with an AIK build not using winbuilder, so not sure why you didn't see it there. Anyway, thanks for this and all your other work with WinFE.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users