RAM EWF still collects memory !

[Stefan Bernögger]

Hi there,

My system with RAM based EWF is collecting little amount
of memory from time to time which causes an overflow (overlay is 10MB)
after few hours.

I already read the newsgroup and checked a lot of postings. The page file
support
is NOT enabled, the auto-defrag is off, and the log-files (Application,
System, Security)
are saved on another partition.

BUT, the memory usage is still growing ... Unfortunately we did not
recognize this
before we started the long-time testing!

Is there another source which is causing the trouble ( I have not found
anything so far)

Maybe somebody has an idea how to solve this problem. What is actually
causing this
collecting of memory. The only application running on the system does not do
anything
with the protected c: partition, registry, etc. (the application exe is not
even on c

Thanks in advance.

Best regards,

Stefan Bernoegger

 

[Doug Hoeffel]

Stefan:

One thing that I overlooked with the RAM-based EWF was with temp file
creation. The default TMP and TEMP user environment variables are defined
as %UserProfile%\Local Settings\Temp which is on the C: drive. I have since
relocated this temp directory to a partition not protected by EWF.

HTH... Doug

 

[Stefan Bernögger]

Thanks for the fast resply, I will try it first tomorrow morning.

Btw, isn't it the same problem with all the MRU-Lists. I saw that when I
open
the "cmd" and type ewfmgr c: I have a certain amount of memory usage. If I
type the
same command several times the amount is not changed, but if I close "cmd"
and
open it again and type the ewfmgr c: I have much more memory usage...

Best regards,

Stefan

 

[BeeFarmer]

We had this exact problem too. Microsoft thought that rebooting once a day
was a solution...
Well not for us... we run 24x7. We ended creating a ram drive and
pointing everything we could
think of to it. Of course Microsoft wasn't much help, helping us know what
files are being written
and how to force them to someplace other than where they are writing..

 

[Myron Zimmerman]

Other sources of file IO include the registry changes, file system meta data
updates such as file access times, and possibly temporary files created by
applications and services.

Myron

 

[joewu]

Hello Stefan,

We suffered this problem too, while we run media player 8.
The usage RAM will be increased random.
Maybe two day the system will down.
Who could help us to slove this problem?

Thanks in advance.

Best Regards
Joe

 

[Slobodan Brcin \(eMVP\)]

Hi,

First you should make sure if this is EWF related problem or not.
You can use ewfmgr to see memory usage made by EWF driver.

If this problem is not related to EWF then please repost your more detailed
question in new thread.

Go to:
www.systeminternals.com

And download regmon and filemon utilities.
You must have them or similar tools to determine how many registry entries
have been changed (the less the better).
And to track all file writes to protected partition. You must minimize this
file count to zero if possible by moving all log files paths to unprotected
medium or ramdrive.

If you know how to use kernel debugger then you can use it to find out this
and some other informations.


Regards,
Slobodan