Disk writes upon startup and shutdown?

[tawnos]

Hello,
I'm trying to ensure no disk writes occur on our Windows XPe system.
To that end, we're using RAM Reg EWF to prevent Windows from
persisting files to disk. However, logic-level analysis shows the
compact-flash card performing writes during startup and shutdown of
Windows. Is this expected behavior, and, if so, is there any way to
prevent these writes? There are concerns about power loss causing card
corruption if the card is writing to the compact flash during an
unexpected powerdown. Since another computer controls the power
supply, we cannot rely on the XPe OS to be in a stable (powered all
the way on or off) state when power is cut.

What files are being written during Windows startup and shutdown? Does
this affect the life-cycle of the compact flash, which supports
limited writes? Any suggestions on how to see what files are being
written?

Thanks,
-Tim Hermann

 

[Sean Liming \(MVP\)]

This is a little known issue, and what you are seeing is correct. If you are
using NTFS, the meta data portion of the disk is not protected by EWF. You
would have to use some forensic analysis tools to see what data is being
writen.

With FAT, there should be nothing writen to since it is a simple File
System.

Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
Book Author - XP Embedded Advanced, XP Embedded Supplemental Toolkit