Hello,
I'm trying to ensure no disk writes occur on our Windows XPe system.
To that end, we're using RAM Reg EWF to prevent Windows from
persisting files to disk. However, logic-level analysis shows the
compact-flash card performing writes during startup and shutdown of
Windows. Is this expected behavior, and, if so, is there any way to
prevent these writes? There are concerns about power loss causing card
corruption if the card is writing to the compact flash during an
unexpected powerdown. Since another computer controls the power
supply, we cannot rely on the XPe OS to be in a stable (powered all
the way on or off) state when power is cut.

What files are being written during Windows startup and shutdown? Does
this affect the life-cycle of the compact flash, which supports
limited writes? Any suggestions on how to see what files are being
written?

Thanks,
-Tim Hermann

This is a little known issue, and what you are seeing is correct. If you are
using NTFS, the meta data portion of the disk is not protected by EWF. You
would have to use some forensic analysis tools to see what data is being
writen.

With FAT, there should be nothing writen to since it is a simple File
System.

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
Book Author - XP Embedded Advanced, XP Embedded Supplemental Toolkit


<(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Hello,
> I'm trying to ensure no disk writes occur on our Windows XPe system.
> To that end, we're using RAM Reg EWF to prevent Windows from
> persisting files to disk. However, logic-level analysis shows the
> compact-flash card performing writes during startup and shutdown of
> Windows. Is this expected behavior, and, if so, is there any way to
> prevent these writes? There are concerns about power loss causing card
> corruption if the card is writing to the compact flash during an
> unexpected powerdown. Since another computer controls the power
> supply, we cannot rely on the XPe OS to be in a stable (powered all
> the way on or off) state when power is cut.
>
> What files are being written during Windows startup and shutdown? Does
> this affect the life-cycle of the compact flash, which supports
> limited writes? Any suggestions on how to see what files are being
> written?
>
> Thanks,
> -Tim Hermann
>