RAM EWF commit question

[Doug G]

I am not entirely clear on the user of the ewfmgr commands "commit" vs.
"commitanddisable" from the standpoint of when they must be used with
RAM-based EWF. If I have RAM-based EWF enabled using the EWF partition
config as opposed to the registry-based config, will a simple "commit" work
for committing changes to the disk, or do I have to use "commitanddisable"?
I guess I'm not clear on why the disable has to be done if I am just trying
to write changes back to the disk, as I can currently do with my disk-based
EWF system.

Doug Gordon

 

[Slobodan Brcin \(eMVP\)]

Hi Doug,

You confused switch "-commit" with switch "-disable".

Commit works always, with all RAM EWF solutions.
Disable do not, because if there is no EWF config partition disable command can't be saved for next boot. (Because EWF protect only
partition that could save this flag)

Regards,
Slobodan

 

[Doug G]

OK, then if I understand correctly, "commitanddisable" is necessary in order
to disable the registry-based EWF because you have to commit the changes to
the registry that tell the system to leave EWF disabled at the next boot.
Correct?

Also, the "commit" with disk-based EWF actually happens during the next
bootup. For RAM-based EWF this must be done prior to shutdown since there
would be no data to commit at the next startup. Also correct?

Doug

Hi Doug,

You confused switch "-commit" with switch "-disable".

Commit works always, with all RAM EWF solutions.
Disable do not, because if there is no EWF config partition disable

command can't be saved for next boot. (Because EWF protect only

 

[Slobodan Brcin \(eMVP\)]

Hi Doug,

OK, then if I understand correctly, "commitanddisable" is necessary in order
to disable the registry-based EWF because you have to commit the changes to
the registry that tell the system to leave EWF disabled at the next boot.
Correct?

Actually it will disable it in registry, and then commit registry change to disk. So this mean that EWF will be disabled at
shutdown. (But it is irrelevant since next time you boot EWF will be disabled.)