About the ewf protected DISK, how to auto restore the MBR space?

[Guest]

Hello, all the experts,

We have use the ewf protect DISK function, build a image with 50MB protected
space. and C drive is protected. D drive is not protected. During our
appliction running, there will be using DirectX, .NET Framework and file
writing in D drive.

Nothing will be written to C drive. but the MBR Space will soon be filled
up and therefore cause the system hang up. We need to run ewfmgr -restore to
solve the problem. But sometimes the ewfmgr -restore cmd will be failed,
Since some process already started.

Any idea about how to auto restore the MBR space? and why the MBR space will
be filled up so soon?

Please help. Thanks.

 

[Greg]

Please excuse cheqinsy,

But am I right that MBR means Master Boot Record ?
And if you've an Image where "Nothing will be written to C drive"
shouldn't this include any access to the MBR ?
So why is it filled up ?
And why do you want to "restore" it instead of searching for the reason ?

Regards, Wolfgang

 

[Guest]

Hi, Greg

Maybe I am wrong about the MBR, what I am mean is the 50MB space which can
be cleaned up by the ewfmgr -restore command.
I don't know why it will be filled up so soon. Nothing will be written to C
drive. But there will be something write to D driver.

I need to know the reason also need to clean it up.

Please advise. Thanks

 

[Greg]

Hi, cheqinsy,

May "FileMon for Windows v7.04" by Mark Russinovich and Bryce Cogswell be
you solution:
http://www.microsoft.com/technet/sysinternals/FileAndDisk/Filemon.mspx
Even if you don't know it there might still be some write accesses.
Another possibility: Do you have a HD activity LED ?
Despite: I'm convinced you should not need to restore regularly if you don't
want.

Regards, Wolfgang

 

[crus]

Hello,
what mode of EWF are you using? I guess you set it as Disk mode
I suppose that for MBR you mean the EWF overlay that is on the disk and
stores all data written to C: .
Your disk should have C: protected, D: unprotected and room for the EWF
partition.
If you have no space on disk for this partition to expand, errors may hang
the system.
Even if your application doesn't write on C: XP needs to write his data:
registry settings, temps event logs pagefile etc...
Docs of Embeded Studio has info about relocating system writings.
Regards