Hibernate, can't see changes to harddisk

[Venkat]

Hi,

When loading from a hibernation file (with EWF enabled) I find that I
cannot view changes to the C: in My Computer (even though I have
bypassed EWF)

This is what I did:

I'm running on a CompactFlash card. I put the system into hibernate
and made sure it was loading from the Hibernation file correctly. Then
I removed the CF card and put it into another computer using a card
reader. I placed a dummy text file "test.txt" onto the drive, then put
the card back into the target system. When I reload from the
hibernation file, I cannot see the text file on the C: !

Does this have something to do with EWF? I thought EWF only protects
the drive from Writes and I should still be able to Read the true
contents of the disk?

Thanks

 

[Slobodan Brcin \(eMVP\)]

Venkant,

I removed the CF card and put it into another computer using a card
reader. I placed a dummy text file "test.txt" onto the drive, then put
the card back into the target system. When I reload from the
hibernation file, I cannot see the text file on the C: !

NO NOT DO THAT!!!!
This has nothing to do with EWF but it is realted to hibertnation itself.

Hibernation process is very delicat and nothing in hardware or open data must not change.
You can change only files on closed filesystems that are not cached in hibernation file.
For instance if you have D: and if you dismounted it before the hibernation then you can change files on it since it will not be
cached in hiber file. (it will be as if it not there)

Writes and I should still be able to Read the true
contents of the disk?

You can read true content of disk trough disk driver but not trough FS that represent interpretation of true content.

Regards,
Slobodan