EwfVolumeConfiguration Class (Standard 7 SP1)

7/8/2014

The EwfVolumeConfiguration class provides information about the configuration of a volume.

The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties.

Syntax

class EwfVolumeConfiguration
{
  uint32  BootCommand;
  string  BootCommandName;
  uint32  BootCommandParam1;
  uint32  BootCommandParam2;
  uint32  ClumpSize;
  uint32  CurrentLevel;
  sint64  DiskOverlayDataSize;
  sint64  DiskOverlayMapSize;
  string  DriveLetter;
  string  HormState;
  uint8[] Identifier;
  uint32  MaximumLevels;
  uint32  MemoryMapSize;
  string  Name;
  uint8[] PersistentData;
  sint64  RamOverlayDataSize;
  uint32  State;
  string  StateName;
  uint32  Type;
  string  TypeName;
};

Members

The EwfVolumeConfiguration class defines the following types of members:

• Properties

Properties

The Ewf class defines the following properties.

• BootCommand

  • Data type: uint32

    Access type: Read-only

    Returns the boot command to be executed on restart.

    Value	Description
    0	EWF_NO_CMD
    1	EWF_ENABLE
    2	EWF_DISABLE
    3	EWF_SET_LEVEL
    4	EWF_COMMIT

• BootCommandName

  • Data type: string

    Access type: Read-only

    Returns the boot command to be executed on restart. The command can be "NO_CMD", "ENABLE", "DISABLE", "SET_LEVEL", or "COMMIT".

• BootCommandParam1

  • Data type: uint32

    Access type: Read-only

    Returns the first parameter of the boot command.

• BootCommandParam2

  • Data type: uint32

    Access type: Read-only

    Returns the second parameter of the boot command.

• ClumpSize

  • Data type: uint32

    Access type: Read-only

    Returns the size of the clumps, in bytes. The default value is 512 bytes.

• CurrentLevel

  • Data type: uint32

    Access type: Read-only

    Returns the current checkpoint level. If the overlay type is "RAM" or "RAM Reg", this always returns 1 for active overlays.

• DiskOverlayDataSize

  • Data type: sint64

    Access type: Read-only

    Returns the size of the data to be stored on disk for the protected volume, in bytes. If the overlay type is "RAM" or "RAM Reg", this always returns 0.

• DiskOverlayMapSize

  • Data type: sint64

    Access type: Read-only

    Returns the size of the mapping data on disk for the protected volume, in bytes. If the overlay type is "RAM" or "RAM Reg", this always returns 0.

• DriveLetter

  • Data type: string

    Access type: Read-only

    Returns the drive letter of the volume.

• HormState

  • Data type: string

    Access type: Read-only

    Returns the state of the HORM functionality. The state can be either "Enabled" or "Disabled".

• Identifier

  • Data type: uint8[]

    Access type: Read-only

    Returns the volume identifier.

• MaximumLevels

  • Data type: uint32

    Access type: Read-only

    Returns the maximum number of checkpoint levels in the overlay.

• MemoryMapSize

  • Data type: uint32

    Access type: Read-only

    Returns the size of the mapping data that is contained in memory for the protected volume, in bytes.

• Name

  • Data type: string

    Access type: Read-only

    Qualifiers: Key

    Returns the name of the volume.

• PersistentData

  • Data type: uint8[]

    Access type: Read/write

    Data that persists through disable, enable, and restore operations. The size of persisted data is supported up to 32 bytes.

• RamOverlayDataSize

  • Data type: sint64

    Access type: Read-only

    Returns the size of the data to be stored in RAM for the protected volume, in bytes. If the overlay type is "Disk", this always returns 0.

• State

  • Data type: uint32

    Access type: Read-only

    Returns the state of the overlay for the volume.

    Value	Description
    0	Enabled
    1	Disabled

• StateName

  • Data type: string

    Access type: Read-only

    Returns the state of the overlay for the volume. The state can be either "Enabled" or "Disabled".

• Type

  • Data type: uint32

    Access type: Read-only

    Returns the type of overlay for the volume.

    Value	Description
    0	Disk
    1	RAM
    2	RAM Reg

• TypeName

  • Data type: string

    Access type: Read-only

    Returns the type of overlay for the volume. The type can be "Disk", "RAM", or "RAM-Reg".

Remarks

When querying for property values with a uint64 or sint64 data type in a scripting language such as VBScript, WMI returns string values. Unexpected results can occur when comparing these values, because comparing strings returns different results than comparing numbers. For example, "10000000000" is less than "9" when comparing strings, and 9 is less than 10000000000 when comparing numbers. To avoid confusion you should use the CDbl method in VBScript when properties of type uint64 or sint64 are retrieved from WMI.

Example

This example can be used to enumerate all instances of EwfVolumeConfiguration.

Windows PowerShell

$ComputerName="localhost"   # or "remote-machine-name"
$Namespace = "root\Microsoft\WriteFilters"
$Class = "EwfVolumeConfiguration"

Write-Host "Retrieving EWF volume configurations..."
$EwfVolumes = Get-WmiObject `
   -ComputerName $ComputerName `
   -Namespace $Namespace `
   -Class $Class 
 
Write-Host "The following volume configurations were found: "
foreach ($EwfVolume in $EwfVolumes) {
   Write-Output $EwfVolume `
}

VBScript

strComputer = "localhost"   ' or "remote-machine-name"
strNamespace = "\root\Microsoft\WriteFilters"
strClass = "EwfVolumeConfiguration"

On Error Resume Next

Set EwfVolumes = GetObject("WINMGMTS:\\" & strComputer & _
   strNamespace).InstancesOf(strClass)

If Err.number <> 0 Then
   WScript.Echo "Method exited with error code: 0x" & Hex(Err.number)
   WScript.Echo Err.source & " - " & Err.Description
   WScript.Quit(1) 
End If

For Each EwfVolume In EwfVolumes
   For Each Prop In EwfVolume.Properties_
      If IsArray(Prop) Then
         WScript.Echo Prop.Name, ": {", Join(Prop.Value, ","), "}"
      Else
         WScript.Echo Prop.Name, ": ", Prop.Value
      End If
   Next
   WScript.Echo "--------------------------------"
Next

Requirements