Write activity to compact flash with EWF enabled

[Guest]

We recently put a scope on the IDE interface signals to our compact flash
card to verify that EWF was indeed protecting the device. Turns out that
there is significant activity at Windows startup and shutdown, O(10**4) write
cycles. Any idea as to the source of this activity is appreciated.

 

[KM]

Servant,

I am not sure about the shutdown but at start up you have obviously the NT loader and kernel (early boot) that use access to the
disk before disk and therefore EWF filter drivers are loaded. Although, those should not be a major concern as they only happen at
reboot times (unless you reboot your device every minute)

 

[Stuart Langley]

I don't know if this is some issue with any particular drivers you might be
using. I have used SHA1 checks to validate that when using EWF not one byte
is changed on the CF card at any stage, over thousands of reboots.

Regards,

Stuart