EWF memory fill-up

  • Thread starter Thread starter Slobodan Brcin \(eMVP\)
  • Start date Start date
S

Slobodan Brcin \(eMVP\)

Hi Carl,

Changes to registry could cause this.
Also there might be small logging done by OS.

Beside 130 MB image size, what is the size of your protected volume?
What happens when my RAM is filled up ?
Click to expand...
Trouble. Like Delayed writes failed, possible services crashes, ....

Best regards,
Slobodan
 
Hello Group

I have asked this question before, but I have not found a solution.

I have an 130 MByte XPE image, and 128 MByte RAM.
When I check EWF status using ewfmgr c: I get the following message:

Memory used for data 6160145 bytes
Memory used for data 12288 bytes

Two hours later with no activity at all i can read:

Memory used for data 6218930 bytes
Memory used for data 12288 bytes

What causes the memory to fill up - is there any loggings going on or ?
What happens when my RAM is filled up ?
How long time will my system operate OK ?

brgds

Carl Johan Jensen
 
Hi Carl,

Your EWF overlay can grow up to ~200-130 MB = ~70 MB of size. So you will more likely experience errors that volume is full then
crashes because memory is full. (Depending on your XPe and program memory usage)

Best regards,
Slobodan
 
Hi Slobodan - thanks for Your reply

The protected volume contains only my XPE OS. The unprotected volume
contains my own code and its data.
In my understanding the EWF stores all changed files of the protected volume
in RAM. Whenever a file of the protected
volume is changed, a copy is written to RAM, and all reads or writes to that
file will be made to the RAM copy (until restart or committing)
Is this true ?

Can You explain howYou calculate the EWF overlay ? In my understanding the
EWF overlay can grow to 130 MByte if all files of the OS
is changed + the size of all files added (or grown).

I have 70 MByte left on my protected volume, when will these MBytes be
filled up by the OS ? What is the OS adding ?
Is it possible to make sure that this will not make and end to my perfectly
working system within at least 5 Years ?

Hope this is not too many questions

brgds

Carl Johan



Slobodan Brcin (eMVP) said:
Hi Carl,

Your EWF overlay can grow up to ~200-130 MB = ~70 MB of size. So you will
Click to expand...
more likely experience errors that volume is full then
 
Hi Carl,
Whenever a file of the protected volume is changed, a copy is written to RAM
Click to expand...
To radical and slow solution.

Actually EWF is ignorant of file existence, and it works below file system driver level. So it actually protect individual sectors,
and only if sector data is changed then this change is stored in memory instead of disk.
Can You explain howYou calculate the EWF overlay ? In my understanding the
EWF overlay can grow to 130 MByte if all files of the OS
is changed + the size of all files added (or grown).
Click to expand...

I was counting on the fact that you will not change all sectors on your disk, (especially ones containing all your binaries).
My mistake you can defragment your OS FS. But you really don't want to do that, trust me.
What is the OS adding ?
Is it possible to make sure that this will not make and end to my perfectly
working system within at least 5 Years ?
Click to expand...

http://msdn.microsoft.com/embedded/community/community/tips/xp/ramewf/default.aspx
BTW: Each restart will purge your overlay data. And if you are asking if you can make device that will work 5 years without reboot?
Then I can say only good luck, since I don't think that anyone can give you answer on this question.

Best regards,
Slobodan
 
Back
Top