How Does EWF Deal with Corrupted Files?

[Gabriel K.]

Imagine we have a system with a
-protected C: drive
-unprotected D: drive (created during FBA)

Once it's up and running, let's say we have files that have been modified
and stored on the new unprotected volume. What happens or how does EWF deal
with the following:

A file on D: has become corrupted. Does it by default ignore the file and
then look in C: for the same file? I figured that EWF works by using a set
of file pointers that points to the modifed (new) files on the unprotected
volume.

Regards,

 

[Sean Liming \(MVP\)]

First, EWF is a volume filter preventing writes being made to a drive that
it is protecting. EWF only effects the volume that it is protecting. If D is
not being protected by EWF, EWF has nothing to do with it - the file is
corrupt. There are no pointers to other files.

Second, how is drive D being created during FBA? Or are you saying that this
is the EWF volume when configured with a Disk Overlay? If so there is no
such thing as drive D. The EWF volume is part of drive C. If a file is
corrupt in the EWF volume than the only way to get to the original file is
either to turn off EWF or drop down an overlay level if enabled.


Regards,

Sean Liming
www.sjjmicro.com / www.seanliming.com
Book Author - XP Embedded Advanced, XP Embedded Supplemental Toolkit

 

[Gabriel K.]

test link to hotmail: <link>http://www.hotmail.com</link>