EWF commit

[FilterChallenged]

My understanding is that it is possible to request the RAM
EWF to commit to media by either using the corresponding
EWF Manager command line (i.e: "ewfmgr c: -commit") or
programatically via the EWF API (EwfMgrCommit() function).

However, I read somewhere that neither method flushes to
media right away but that the data is actually commited
during the next shutdown. Is this true?

Is there a way to force the EWF to actually commit on
demand without having to reboot?

 

[Slobodan Brcin \(eMVP\)]

My understanding is that it is possible to request the RAM

EWF to commit to media by either using the corresponding
EWF Manager command line (i.e: "ewfmgr c: -commit") or
programatically via the EWF API (EwfMgrCommit() function).
Correct.

However, I read somewhere that neither method flushes to
media right away but that the data is actually committed
during the next shutdown. Is this true?

Yes, they are committed during the first graceful shutdown.

Is there a way to force the EWF to actually commit on
demand without having to reboot?

In current implementation there is no such option. And for future
implementations that option is technically impossible to make.

But MS could support instant commitanddisable without the need for reboot.
Current implementation also requires the restart.

Regards,
Slobodan

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Have an opinion on the effectiveness of Microsoft Embedded newsgroups? Tell
Microsoft!
https://www.windowsembeddedeval.com/community/newsgroups
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[KM]

And just to add to that...

But MS could support instant commitanddisable without the need for reboot.
Current implementation also requires the restart.

This is EWF implementation restriction. There are other write filters on the
market.
E.g., Write Filter from VenturCom (don't know if they sell it yet). You can
commit and disable WF without system reboot there.

Regards,
Slobodan

KM