Corrupt Partitions NOT protected by EWF

[Doug Hoeffel \(eMVP\)]

Hello:

My system uses XPe SP1 with the RAM-based EWF. My HD has 3 NTFS partitions
not including the hidden EWF partition. Only my boot partition is protected
by EWF. One thing to note is that 99% of the time shutdown is always via
loss of power. There is no graceful shutdown under normal usage. The only
time I have a graceful shutdown/restart is when I perform it
programmatically after a EWF commit. BTW, I have never seen my boot
partition get corrupted once the EWF is enabled.

In the field, I am starting to see corruptions on my 2 other NTFS partitions
which are not protected by the EWF. I need these partitions since I have to
store configuration and image data somewhere persistant. In most cases,
chkdsk detects a dirty partition and can fix it. In one case, things were
so dorked up that chkdsk could not run because I had a corrupt master file
table.

I do have autochk/chkdsk looking for the dirty bit set on my 2 non-EWF
protected partitions via the Session Manager/BootExecute registry key
containing "autocheck autochk /k:C *".

Also, I have disabled 8.3 name generation via:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"NtfsDisable8dot3NameCreation"=dword:00000001

After some googling, I found the following (although I'm not currently
deploying this):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"DisableNTFSLastAccessUpdate"=dword:00000001

which disables the last access timestamp from being updated when a file is
read. I think the idea here is to eliminate a write to disk just because a
file is read.

So, does anyone have any other idea's on how to reduce the disk access, i.e.
chattiness, of the NTFS file system? Under most cases I think that power is
removed from my box when my s/w is effectively idle, i.e. I'm not in the
middle of writing a file.

TIA... Doug

 

[BeeFarmer]

We have pretty much the same issue however it is the TIF that corrupt the
..dat file causing the CF to
fill up. This normally happens when we get a abrupt power outage. Unlike
you we don't store any
info on the CF so a ramdrive keeps the .dat file now. I guess my reply is
to say we are similar in
the fact that corruption happens and we solved ours by using a ramdrive.

 

[Slobodan Brcin]

Hi Doug,

My configuration:
256MB C: - XPe and our App. (68 MB actually occupied.)
2GB - NTFS (temporary files used for CD stash, etc)
115+GB RAW partition. (Used by our application)

I don't know how to make NTFS less chattier, but you can store your
configuration infos, etc in raw partition.
Treat partition as one file with fixed size. Since there is no file system,
everything is up to you to organize your data.

I can't think better solution than this, if you find it let me know.


Regards,
Slobodan

 

[Ed Kokkila]

Doug,

Do you have 'write caching' enabled on you hard drive?

To find out, go to Device Manager->Disk Drives and right click on your hard
drive. Select Properties. Select the Policies tab. If checkbox next to 'Enable
write caching on the disk' is checked then all of your writes to all partitions
are being cached in memory. Unchecking this box will force all writes to go
immediately to the disk.

EAK

 

[Doug Hoeffel \(eMVP\)]

Ed:

Thanks for the input.

Did you notice any degradation in performance once you disabled the HD write
cache?

Thanks... Doug

Doug,

Do you have 'write caching' enabled on you hard drive?

To find out, go to Device Manager->Disk Drives and right click on your hard
drive. Select Properties. Select the Policies tab. If checkbox next to 'Enable
write caching on the disk' is checked then all of your writes to all partitions
are being cached in memory. Unchecking this box will force all writes to go
immediately to the disk.

EAK

Hello:

My system uses XPe SP1 with the RAM-based EWF. My HD has 3 NTFS partitions
not including the hidden EWF partition. Only my boot partition is protected
by EWF. One thing to note is that 99% of the time shutdown is always via
loss of power. There is no graceful shutdown under normal usage. The only
time I have a graceful shutdown/restart is when I perform it
programmatically after a EWF commit. BTW, I have never seen my boot
partition get corrupted once the EWF is enabled.

In the field, I am starting to see corruptions on my 2 other NTFS partitions
which are not protected by the EWF. I need these partitions since I have to
store configuration and image data somewhere persistant. In most cases,
chkdsk detects a dirty partition and can fix it. In one case, things were
so dorked up that chkdsk could not run because I had a corrupt master file
table.

I do have autochk/chkdsk looking for the dirty bit set on my 2 non-EWF
protected partitions via the Session Manager/BootExecute registry key
containing "autocheck autochk /k:C *".

Also, I have disabled 8.3 name generation via:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"NtfsDisable8dot3NameCreation"=dword:00000001

After some googling, I found the following (although I'm not currently
deploying this):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"DisableNTFSLastAccessUpdate"=dword:00000001

which disables the last access timestamp from being updated when a file is
read. I think the idea here is to eliminate a write to disk just because a
file is read.

So, does anyone have any other idea's on how to reduce the disk access, i.e.
chattiness, of the NTFS file system? Under most cases I think that power is
removed from my box when my s/w is effectively idle, i.e. I'm not in the
middle of writing a file.

TIA... Doug

 

[Doug Hoeffel \(eMVP\)]

Slobodan:

So basically you created your own file system since your software is
managing the raw partition? Did you write a device driver for this?

Thanks... Doug

Hi Doug,

My configuration:
256MB C: - XPe and our App. (68 MB actually occupied.)
2GB - NTFS (temporary files used for CD stash, etc)
115+GB RAW partition. (Used by our application)

I don't know how to make NTFS less chattier, but you can store your
configuration infos, etc in raw partition.
Treat partition as one file with fixed size. Since there is no file system,
everything is up to you to organize your data.

I can't think better solution than this, if you find it let me know.


Regards,
Slobodan

Hello:

My system uses XPe SP1 with the RAM-based EWF. My HD has 3 NTFS partitions
not including the hidden EWF partition. Only my boot partition is protected
by EWF. One thing to note is that 99% of the time shutdown is always via
loss of power. There is no graceful shutdown under normal usage. The only
time I have a graceful shutdown/restart is when I perform it
programmatically after a EWF commit. BTW, I have never seen my boot
partition get corrupted once the EWF is enabled.

In the field, I am starting to see corruptions on my 2 other NTFS partitions
which are not protected by the EWF. I need these partitions since I

have

to
store configuration and image data somewhere persistant. In most cases,
chkdsk detects a dirty partition and can fix it. In one case, things were
so dorked up that chkdsk could not run because I had a corrupt master file
table.

I do have autochk/chkdsk looking for the dirty bit set on my 2 non-EWF
protected partitions via the Session Manager/BootExecute registry key
containing "autocheck autochk /k:C *".

Also, I have disabled 8.3 name generation via:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"NtfsDisable8dot3NameCreation"=dword:00000001

After some googling, I found the following (although I'm not currently
deploying this):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"DisableNTFSLastAccessUpdate"=dword:00000001

which disables the last access timestamp from being updated when a file is
read. I think the idea here is to eliminate a write to disk just

because

a
file is read.

So, does anyone have any other idea's on how to reduce the disk access, i.e.
chattiness, of the NTFS file system? Under most cases I think that

power

is
removed from my box when my s/w is effectively idle, i.e. I'm not in the
middle of writing a file.

TIA... Doug

 

[Slobodan Brcin]

Yes I have created my well data system (not file system).

At first it was implemented in one dll (user mode). Now it is normal kernel
driver as it should be.

But basically you can open RAW partition for example \\.\D: and use is to
write and read data as you would in one big file.

You'll have alignment restriction of 512 bytes but this is easily overcomed.

Regards,
Slobodan

Slobodan:

So basically you created your own file system since your software is
managing the raw partition? Did you write a device driver for this?

Thanks... Doug

Hi Doug,

My configuration:
256MB C: - XPe and our App. (68 MB actually occupied.)
2GB - NTFS (temporary files used for CD stash, etc)
115+GB RAW partition. (Used by our application)

I don't know how to make NTFS less chattier, but you can store your
configuration infos, etc in raw partition.
Treat partition as one file with fixed size. Since there is no file system,
everything is up to you to organize your data.

I can't think better solution than this, if you find it let me know.


Regards,
Slobodan

Hello:

My system uses XPe SP1 with the RAM-based EWF. My HD has 3 NTFS partitions
not including the hidden EWF partition. Only my boot partition is protected
by EWF. One thing to note is that 99% of the time shutdown is always via
loss of power. There is no graceful shutdown under normal usage. The only
time I have a graceful shutdown/restart is when I perform it
programmatically after a EWF commit. BTW, I have never seen my boot
partition get corrupted once the EWF is enabled.

In the field, I am starting to see corruptions on my 2 other NTFS partitions
which are not protected by the EWF. I need these partitions since I

have

to
store configuration and image data somewhere persistant. In most cases,
chkdsk detects a dirty partition and can fix it. In one case, things were
so dorked up that chkdsk could not run because I had a corrupt master file
table.

I do have autochk/chkdsk looking for the dirty bit set on my 2 non-EWF
protected partitions via the Session Manager/BootExecute registry key
containing "autocheck autochk /k:C *".

Also, I have disabled 8.3 name generation via:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"NtfsDisable8dot3NameCreation"=dword:00000001

After some googling, I found the following (although I'm not currently
deploying this):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"DisableNTFSLastAccessUpdate"=dword:00000001

which disables the last access timestamp from being updated when a

file

is because access,
i.e. power

 

[Ed Kokkila]

Doug,

Hibernate images take considerably longer to generate, but otherwise, the
performance is pretty good.

EAK

Ed:

Thanks for the input.

Did you notice any degradation in performance once you disabled the HD write
cache?

Thanks... Doug

Doug,

Do you have 'write caching' enabled on you hard drive?

To find out, go to Device Manager->Disk Drives and right click on your hard
drive. Select Properties. Select the Policies tab. If checkbox next to 'Enable
write caching on the disk' is checked then all of your writes to all partitions
are being cached in memory. Unchecking this box will force all writes to go
immediately to the disk.

EAK

Hello:

My system uses XPe SP1 with the RAM-based EWF. My HD has 3 NTFS partitions
not including the hidden EWF partition. Only my boot partition is protected
by EWF. One thing to note is that 99% of the time shutdown is always via
loss of power. There is no graceful shutdown under normal usage. The only
time I have a graceful shutdown/restart is when I perform it
programmatically after a EWF commit. BTW, I have never seen my boot
partition get corrupted once the EWF is enabled.

In the field, I am starting to see corruptions on my 2 other NTFS partitions
which are not protected by the EWF. I need these partitions since I have to
store configuration and image data somewhere persistant. In most cases,
chkdsk detects a dirty partition and can fix it. In one case, things were
so dorked up that chkdsk could not run because I had a corrupt master file
table.

I do have autochk/chkdsk looking for the dirty bit set on my 2 non-EWF
protected partitions via the Session Manager/BootExecute registry key
containing "autocheck autochk /k:C *".

Also, I have disabled 8.3 name generation via:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"NtfsDisable8dot3NameCreation"=dword:00000001

After some googling, I found the following (although I'm not currently
deploying this):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem]
"DisableNTFSLastAccessUpdate"=dword:00000001

which disables the last access timestamp from being updated when a file is
read. I think the idea here is to eliminate a write to disk just because a
file is read.

So, does anyone have any other idea's on how to reduce the disk access, i.e.
chattiness, of the NTFS file system? Under most cases I think that power is
removed from my box when my s/w is effectively idle, i.e. I'm not in the
middle of writing a file.

TIA... Doug