EWF really suck!!!

  • Thread starter Thread starter reginald.louis
  • Start date Start date
R

reginald.louis

Ok, I test the 3 modes of EWF (Disk, Ram, Ram Reg) and this is what I
found:

My setup:
1 HD of 2 GB with only 1 partition (XPe is using 500MB)
256MB of memory
EWF RAM enable (protecting my only partition)
Pagefile disable

1 - Immedialty after boot time, at idle, XPe use 60MB of memory, so I
have 196MB of free RAM

2 - I copy a folder of 40MB from a remote computer (using filesharing)
to my XPe C:\ folder. Since I have EWF RAM enable, my free RAM go from
196MB to 156MB. That's fine, everything act like I suppose.

3 - I delete this folder and my free RAM still at 156MB instead of
going up to 196MB.

4 - I re-copy the same folder and the memory go down to 116MB.

5 - Repeat step 3 and 4 until I have to free RAM left and get a "Write
delays fail..." from windows.

WHY, WHY WHY the EWF doesn't release the memory when I delete a file
that was store there???? Linux doesn't do that so WHY Xpe do this
stupidity??? I'm sure that event the ramdisk found on old dos (or
Win98 bootdisk) doesn't do that!!!

I need a explanation of if there is a descent way to avoid this!!!
 
When you say "Linux doesn't do that" what specifically component do you mean?
Sounded like you're trying to compare apples to oranges.

EWF is an upper filter driver in the volume stack. It protected data on the disk level, not on a file system level.
This means as soon as you copy a file the EWF overlay consumption will grow by the number of clusters that file occupied. Obviously,
deleting the file is only a change in the file table (on FAT, a little bit more on NTFS) and may only increase the overlay usage.

When you re-copying the file the file system (often) won't be using the same disk clusters for the new file (yes, the new copy is
properly considered as a new file) and therefore your EWF usage is increased again.

Nothing wrong in the testing scenario results you showed. Except maybe the fact that EWF doesn't handle gracefully the overlimit for
the memory consumption (you saw tat scary "Write delays failed." messages.
FBWF (next generation filter) does that, though.

Please read about the EWF architecture first: http://msdn2.microsoft.com/en-us/library/ms838511.aspx
And here: http://msdn2.microsoft.com/en-us/library/ms912909.aspx
 
When you say "Linux doesn't do that" what specifically component do you mean?
Sounded like you're trying to compare apples to oranges.

EWF is an upper filter driver in the volume stack. It protected data on the disk level, not on a file system level.
This means as soon as you copy a file the EWF overlay consumption will grow by the number of clusters that file occupied. Obviously,
deleting the file is only a change in the file table (on FAT, a little bit more on NTFS) and may only increase the overlay usage.

When you re-copying the file the file system (often) won't be using the same disk clusters for the new file (yes, the new copy is
properly considered as a new file) and therefore your EWF usage is increased again.

Nothing wrong in the testing scenario results you showed. Except maybe the fact that EWF doesn't handle gracefully the overlimit for
the memory consumption (you saw tat scary "Write delays failed." messages.
FBWF (next generation filter) does that, though.

Please read about the EWF architecture first:http://msdn2.microsoft.com/en-us/library/ms838511.aspx
And here:http://msdn2.microsoft.com/en-us/library/ms912909.aspx
Click to expand...

Will MS will come with a new kind of filter or ram disk so it can't
act like as said before? Can I install a ramdisk on windows?
 
Will MS will come with a new kind of filter or ram disk so it can't
act like as said before? Can I install a ramdisk on windows?
Click to expand...

Please read the FP2007 docs about FBWF (new file based write filter). It doesn't do all you may need but way more enhanced and file
aware than the older EWF: http://msdn2.microsoft.com/en-us/library/aa940926.aspx.


Thee is no ramdisk component in the database (the "Windows RAM Disk Driver" component there is just for system RAM (Remote) boot
scenarios).
If you want to implement a ram drive, you should take a look at and componentize MS RamDisk sample driver:
http://support.microsoft.com/?kbid=257405 (although it is a sample driver for Win2K but it works great on XP if you follow the
instructions on that KB page).

You can also find a list of existing ram-disks for XP on http://lists.gpick.com/pages/RAM_Disks.htm.
 
Hello KM,

I tried this link and get page cannot be displayed. Is the link incorrect
or is it the site is down?

Thanks,

Deb
 
Hi Debbie,

What link you are referring to? I posted at least three links in my previous reply.
I just checked.. All links work except the last one that goes to gpick.com. I was browsing to that website a while ago and it worked
so I assume it may be down temporarily. Who knows, check it out later :-)

But here is another RAM disk driver for you with source code available (XP/2K):
http://www.codeguru.com/Cpp/W-P/system/devicedriverdevelopment/article.php/c5789

Or use this one: http://www.picobay.com/projects/2006/06/how-to-make-windows-xp-ram-disk-drive.html (the binaries are downloadable
there)
Using 3rd party software, however, please pay attention to their license.

I bet there plenty more RAM disk out there if you search Google.
 
Back
Top