Ewf live command

[Mark]

Hey all

I was wondering if there was a way to commit changes to the hard disk
without rebooting. If you run ewfmgr c: -commitanddisable -live then
the ewf is disabled. If you run ewfmgr c: -commitanddisable -live, then
run ewfmgr c: -enable, will that allow me to commit the changes without
rebooting?

If this is not the case, and MS is reading this, please in the future
add this capability. Another good option would be to see the percentage
used when using the RAM based overlay. I believe the gauge option is
only available for disk based overlays.

Thanks all

 

[Slobodan Brcin \(eMVP\)]

Hi Mark,

I bet that MS (guy that wrote EWF driver) could make commitlive switch in matter of minutes.
This option do not exist as prevention since you would save working system in unknown state and compromise very thing that EWF
represent.

You could commit some random snapshot from overlay to disk that would be same as if you pulled the plug on regular system but with
slight difference that on regular system you could have chance of recovery on XPe system with EWF on there would be no chance to
repair the damage.

They have option -commitanddisable -live. But by not doing disable they would give you what you ask, unfortunately then they would
have too many complains on stability of EWF and XPe system.

Regards,
Slobodan