EWF RAM Overlay - limit amount of ram used

[Guest]

Hi,

I'm using the EWF with a RAM overlay to protect my disk on module chip.

The documentation for the EWF implies that the amount of ram used will
increase until there is no more memory available.

Is there a way to set an upper limit on how much ram is used?

On a different but simlar note: Doing a commit and disable live doesn't
seem to return the RAM to the system. Has anyone else noticed this behavior?

Thanks.

 

[Slobodan Brcin \(eMVP\)]

Hi Silent,

The documentation for the EWF implies that the amount of ram used will
increase until there is no more memory available.

Actually until your system start crashing because it is out of memory, but it is the same.

You can't limit how much EWF will grow :-(
But what you can do is to analyze your image write behavior.

For instance if you have protected partition of 128 MB then worst case scenario of memory usage would be ~129 MB.
Fortunately you will protect OS partition which contain some files that will usually not change (OS files that won't be updated
without your knowledge). So let us say that OS is 90 MB in size.
Then worst case scenario for RAM EWF overlay memory usage would be 30-40 MB. This is the amount of data that can be written to your
FS and then it will be full and XPe will report that you are out of space but you will have most of your memory available.

Regards,
Slobodan

 

[Guest]

Thanks. That's good to know. It will also help to clear some up some
misconceptions of the XPe write filter. Because we still support our NTe
images and it's write filter we're still re-educating ourselves.

Thanks again

 

[David D]

If you have things that log then it will definitly grow and grow. For
example, if you have various IIS logging turned on.
This will increment slowly but surely.
I've considered having our system reboot once a night or once a week
automatically early in the morning.

David