[newbie] problem with EWF

[Lloyd Dupont]

I added the "Enhanced Write Filter" component in my XPe image.
In its settings I set the overlay ype to RAM.

Now I booted my new image, run through FBA then created a file.txt file on
my root dir and rebooted.
When it restarted the file.txt was still there?!?
How come?
I thought the EWF means every change is in memory only, and nothing should
be written to the disk?

 

[Mike Warren]

I added the "Enhanced Write Filter" component in my XPe image.
In its settings I set the overlay ype to RAM.

Now I booted my new image, run through FBA then created a file.txt
file on my root dir and rebooted. When it restarted the file.txt was
still there?!? How come?
I thought the EWF means every change is in memory only, and nothing
should be written to the disk?

The filter is probably switched off.

Did you include "EWF Manager" component in your image?

If so, open a command prompt and type ewfmgr c:

Check the result to see if it is enabled and gives no errors

If it is simply disabled, then it can be enabled by typing:

ewfmgr c: -enable

then reboot.

I find RAM(REG) mode easier to use. No extra partition is required.

 

[Lloyd Dupont]

I did not include the EWF Manager.
When I look at the settings of EWF it mention an EWF Volume Config. It's all
left to the default, i.e. EWF partition is 0KB, I wonder if that might be a
problem.

Also I just changed the Overlay Type to RAM (Reg) (instead of just RAM) as
you advised, although I'm at loss to know the difference..