| Author | Message | ||
     AlanOne Username: alanone Registered: N/A |
I have been trying to create a BartPE disk with Forensics on it, however, when I boot the BartPE disk and try to run the program, I get the message: "Exception situation type 216 occurred at offset 00000000. It is recommended..." I have the dongle plugged in and it appears to be active. Thanks, Tim | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
Sorry, cannot find your name in our records as a user of X-Ways Forensics. Please feel free to clarify by sending e-mail. Thanks. | ||
| Tim Courson Username: alanone Registered: N/A |
I sent an e-mail to the admin address. Sorry for the confusion. Tim | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
We can make attempts at identifying that problem that seems to be specific to BartPE in a few weeks. In the meantime my offer is to send you download links for other versions of X-Ways Forensics by e-mail for you to try, as I know X-Ways Forensics did run OK under BartPE (with limitations, though) some time ago. | ||
| Tim Courson Username: alanone Registered: N/A |
Very good. You can send the link to the address in my previous e-mail I sent you, or send it to my partner's address on file. She will then forward it to me. Thanks, Tim | ||
| Bob Dewald Username: bdewald Registered: 7-2005 |
I recently created a CD and tried using the XWF BartPE plugin that was on this website for two different versions of WinHex and XWF. One version of each was one of the last pre-dongle versions (requiring user.txt) and one was more current and required a dongle (which I have). I wasn't able to get any of the 4 to work on the current version of BartPE. I was able to get plugins for other products to work so I think I have the general concept down, but may be missing something relative to the XWF/WinHex plugin. I would appreciate any and all feedback on this topic. Thanks... | ||
| Jimmy Weg Username: jw Registered: 7-2006 |
I've used WinHex (non-dongle) with Bart for quite some time. I'm not sure what you mean by being unable to get it "to work." One thing that I do is set my options for a BartPE environment, so that temp files and the like don't try to write to a location that may not exist in a BartPE environment. Of course, my User.txt is current. I don't have access at the moment to my PE Builder, but it's not a newer release. | ||
| Bill Spernow Username: byteguy Registered: N/A |
I've had no problem getting XWF ver. 13.0 (user.txt) to work with BartPE ver. 3.1.10a using XP Pro, but I've been unable to get any of the XWF versions that require a dongle to work. All error out with Error Code 216 at offset 00000000. Guessing one of the USB system calls that are made when trying to talk to the dongle are not available in this scaled down version of XP. Bill Spernow | ||
| Bob Dewald Username: bdewald Registered: 7-2005 |
Thanks Jimmy and Bill. I will try again with v13.0_SR0. I will provide specifics regarding results. | ||
| Bill Spernow Username: byteguy Registered: N/A |
Finally got ver 13.9 with the dongle to work under BartPE running XP Pro SP2. Seems the trick is to make sure you have loaded both the XPE and HwPnP plugins (http:\xpe.collewijn.info) into your environment. The default settings on these two plugins work perfect, no need to dink with any settings. The *.INF and *.XML configuration files provided by XWF (Björn Ganster) for WinHex and X-Ways Forensic also work without any modifications. Guessing that XPE and HwPnP enable some USB function you don't get without them. Also note that the dongle needs to be in place BEFORE you boot the CD. Trying to add it after the fact did not work with my set-up. FYI: I wanted to include the URL to the BartPE configuration files created by Björn Ganster to save everyone the trouble of getting them but I wasn't able to find the link again, they hide it pretty well. All I remember was that the download link was at the very bottom of one of the X-Ways pages I found. | ||
| Björn Ganster Username: admin4 Registered: 3-2004 |
The BartPE config files for WinHex are available for download from http://www.x-ways.net/winhex/BartPE.zip | ||
| Bill Spernow Username: byteguy Registered: N/A |
Björn, thanks for the link... Forgot to mention two Gotchas: (1) XPE requires a Plugin.ocx to be in the source i386 folder but it does not provide it. This file can be found at: http://www.ocxdump.com/download-ocx-files_new.php/ocxfiles/P/plugin.ocx/6.00.2800.11066/download.html (2) If you are using a SP2 XP Pro install disk as the source of your system files be advise some OEMs have renamed the i386 folder to I386, if that's the case BartPE will not be able to find this folder as its looking for "i386" Bill Spernow | ||
| Bob Dewald Username: bdewald Registered: 7-2005 |
It's been a while since I posted my question, but I want to thank you all for your answers. I followed your advice and was able to get the plugins working for current versions of XWF and Winhex. |