EWF RAM overflow

[Helmuth]

Hi everyone!

I have an embedded system with two EWF protected
partitions (c: and d. When I type ewfmgr c:, I get the
following display:

Type: RAM
State: Disabled
Boot Command: No_Command
Param1: 0
Param2: 0
Persistent Data: ""
Volume ID: af cc 07 00 00 7e 00 00 00 00 00 00 00 00 00 00
Device Name: "\Device\HarddiskVolume1" [c:]
Max Levels: 1
Clump Size: 512
Current Level: 1
Memory used for data 0 bytes
Memory used for mapping 0 bytes

In the target designer the following was entered:

Maximum number of protected volumes: 2
Maximum number of overlay levels: 1
EWF partition size: 2048 kB
Protected volume # 1:
Start EWF enabled: not checked
Enable Lazy write: not checked
Disk number: 0
Partition Number: 1
Disk Type: IDE
Overlay Type: RAM
Optimisation Option: Optimal Performance

Similarly for d:.

There is a section of 30 MB unformatted space on the hard
disk, which is available to the EWF.

As I understand: I have one non persistent RAM overly. All
the write data is stored in my RAM and in particular in a
segment of 2048 kB.

Why do I have an EWF partition then? Why is this
necessary? Is this used to store the EWF configuration
information?

What will happen if more than 2048 kB have to be stored in
the EWF partition in my RAM? Will there be a RAM overflow?
Will there be an error message? Does the system crash?
Does it continue to write data into the EWF partition on
the harddisk? What happens then when this partition (30
MB) is also filled up?

Thank you for your help!
Helmuth

 

[Slobodan Brcin \(eMVP\)]

Hi Helmuth,

Just few answers for rest use google groups to search this NG for EWF.
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&q=RAM+EWF&btnG=S
earch&meta=group%3Dmicrosoft.public.windowsxp.embedded.*

1. RAM EWF uses either registry or ultra small config partition. (Not for
data just for enable disable switches)
2. For protection only one partition you can use registry to configure RAM
EWF.
3. For more than one RAM EWF protected partition you must use small config
EWF partition. (Minimum partition size that XP can create is around 8 MB)
4. You should redirect all temporary writes to some unprotected partition.
5. If you fill up all the RAM then anything can happen, no rules but one is
certain your device will crash in unexpected way. No matter what happen your
original data on disk will remain unchanged by that crash.
6. If you configure your XPE well EWF can consume less than few MB or RAM
for overlay.
7. Again data from RAM overlay are only written in RAM.

Regards,
Slobodan

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Have an opinion on the effectiveness of Microsoft Embedded newsgroups? Tell
Microsoft!
https://www.windowsembeddedeval.com/community/newsgroups
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Hi everyone!

I have an embedded system with two EWF protected
partitions (c: and d. When I type ewfmgr c:, I get the
following display:

Type: RAM
State: Disabled
Boot Command: No_Command
Param1: 0
Param2: 0
Persistent Data: ""
Volume ID: af cc 07 00 00 7e 00 00 00 00 00 00 00 00 00 00
Device Name: "\Device\HarddiskVolume1" [c:]
Max Levels: 1
Clump Size: 512
Current Level: 1
Memory used for data 0 bytes
Memory used for mapping 0 bytes

In the target designer the following was entered:

Maximum number of protected volumes: 2
Maximum number of overlay levels: 1
EWF partition size: 2048 kB
Protected volume # 1:
Start EWF enabled: not checked
Enable Lazy write: not checked
Disk number: 0
Partition Number: 1
Disk Type: IDE
Overlay Type: RAM
Optimisation Option: Optimal Performance

Similarly for d:.

There is a section of 30 MB unformatted space on the hard
disk, which is available to the EWF.

As I understand: I have one non persistent RAM overly. All
the write data is stored in my RAM and in particular in a
segment of 2048 kB.

Why do I have an EWF partition then? Why is this
necessary? Is this used to store the EWF configuration
information?

What will happen if more than 2048 kB have to be stored in
the EWF partition in my RAM? Will there be a RAM overflow?
Will there be an error message? Does the system crash?
Does it continue to write data into the EWF partition on
the harddisk? What happens then when this partition (30
MB) is also filled up?

Thank you for your help!
Helmuth