Difference in EWF and FBWF commit

[Guest]

Hi All,

I have ATX type power switch on my XPe system which after pressing for 5
seconds calls the windows shut down function and the system safely shuts
down.
I first applied Enhanced Write Filter on my protected volume. Then I added a
new text file to my protected volume and changed the desktop wallpaper. After
that I entered ewfmgr c: -commit command from command prompt. Then I reboot
the system from start menu. At the next start both the settings were saved on
the system.
Next step I did the same changes again and this time with out rebooting from
Start menu, I used the ATX switch to shut down, the system showed “Windows
Shutting Down†message. On next boot the settings were lot
Then I applied File Based Write Filter on the same volume. This time I
created a new text file and saved it on protected volume (not on the write
through region) I restated the system from the ATX power switch. This time on
next restart the file was restord on the protected volume.
This is a strange behavior, is there any change in EWF commit and FBWF
commit (In case of FBWF it is a commit file). Is it possible to save my
settings in case of EWF using ATX switch for power off (Since on our system
there is no provision for soft shut down from GUI).
Any one know how to take care of calling any function/API which will save my
settings as in case of reboot from start menu?

Thanks & Regards
Roshan.

 

[KM]

Roshan,

FBWF and EWF certainly commit differently - one is file system level driver, another is disk upper filter.

Basically you have to make sure you do a graceful shutdown to the system so that EWF can commit the changes (which does that at the
shutdown time if you use RAM mode).
Btw, you could use -live switch of the new EWF to commit the changes immediately.

Did you do the commit in FBWF test? (You didn't mention that) For instance, you could've just excluded the file on protected volume
to make it persistent.
If you did, since the overlay cache for FBWF (in the scenario you described) is probably smaller than for EWF the driver gets enough
time to flush it when you press the power button.

Are you sure you pressing the button for more than 5 seconds and it does the graceful shutdown for the system? Typically it shuts
the power off immediately if you press the button for more than 4 secs on ATX.


We have discussed the power button shutdown and its impact on the write filter flush in this newsgroup a few times. You may want to
search the NG archive.

 

[Guest]

Hello KM,

I did some more tests to verify the difference in EWF and FBWF commits,
using ATX switch to shutdown the system. I entered commit command in both the
cases from command prompt. Every time I found the changes are getting
committed in case of FBWF and not in case of EWF.
I have even tested for ATX switch, it does not perform graceful shutdown, it
only call the shutdown API since after 5 sec holding the power switch I can
see the message “Windows Shutting Downâ€, but it did not show “Saving your
settings†message. I have created a text file and edit some changes in it and
did not save the file. At the time of shutting down I did not get any system
message to save changes to my file, and obviously the changes I had made were
gone at next restart.

My biggest problem is my system is not going to have any option for graceful
shutdown due to which I cannot use EWF on my system, since commit wont work
here. I guess I will have to use the FBWF filter with some folders as write
through to save changes directly.
Anyways thanks for your reply and the information.

Regards
Roshan.

 

[KM]

Roshan,

As I mentioned earlier, how about using -live switch of the EWFMgr?
At least you will be able to "move" the actual commit to the time you issue it vs the shutdown time.

 

[Guest]

Hello KM,

I think the -live command works with the combination of -commitanddisable
command, and in that case i will have to re-enable the EWF in next reboot and
perform one more restart to make write filter effective.
I was looking for the option where I should be able to commit the changes to
protected volume without the need to restart the machine because the system
will not be having elegant shutdown option.

Thanks & Regards
Roshan.

 

[KM]

Oh, I see. You want to avoid PC reboots and be able to commit changes live with a write filter installed.

With EWF we've typically done that by moving all the persistency required data to an unprotected partition and making sure all the
data writes are flushed periodically and after the disk-write-API calls wherever possible.

With FBWF however it becomes an easier process. At least you don't have to move data (and change applications to support that logic)
around partitions but rather play with the write-through list. Still make sure to flush the data since your device is not
hardware-protected from sudden shutdowns.