Ram required for EWF?

[David Ditch]

I keep seeing information saying that if you run a RAM EWF that you
basically need 2x the size of your persistant storage.
This does not make sense to me. If most of the files on your storage is
being read and not written to, why is so much ram needed. Seems inefficient.

David

 

[Slobodan Brcin]

I keep seeing information saying that if you run a RAM EWF that you

basically need 2x the size of your persistant storage.
This does not make sense to me. If most of the files on your storage is
being read and not written to, why is so much ram needed. Seems

inefficient.

This is nonsense where did you read that info?

You need few megabytes at most.


Best regards,
Slobodan

 

[Andy Allred [MS]]

David, You're probably thinking of Ramdisk for Remote Boot, which basically
needs twice the ram compared to the size of the runtime.

Read this David, especially the first "Note:" on the page:
http://msdn.microsoft.com/library/en-us/remboot/html/xpconRemoteBootOverview.asp

This is unrelated to EWF's requirements for a RAM Based overlay.

Andy

 

[David Ditch]

Thank you for the quick responses.

What I saw was here:
http://msdn.microsoft.com/chats/embedded/embedded_080703.asp
It is the Second Q/A on that page I refer to
The question was posed about an ElTorito drive and RAM based EWF.
I however am using compact flash.
I have a 256MB compact flash. I am basically making a Browser in a Box
application that will be viewing web pages on a local site on the LAN.
Should not be much writing to my protected drive.
My application can run fine on 128MB of RAM and I was planning on installing
256MB ram to leave room for write filtering.

David

 

[KM]

Then what does the following mean?
"...
Note A RAM overlay requires additional memory that equals the size
of the volume that is to be protected by EWF.
...
"

cut from:
http://msdn.microsoft.com/library/en-us/xpehelp/html/xeconEnhancedWriteFilte
r.asp

SB> inefficient.

SB> This is nonsense where did you read that info?

SB> You need few megabytes at most.


SB> Best regards,
SB> Slobodan


With best regards, KM. E-mail: (e-mail address removed)

 

[Slobodan Brcin]

Then what does the following mean?

Note A RAM overlay requires additional memory that equals the size
of the volume that is to be protected by EWF.

At least it is not double size

Dan or Andy will probably explain this.


Best regards,
Slobodan

 

[David D]

Right now, I have maxed out my memory for my board (255MB)
When I try to copy 8mb onto my protected volume, part of the way through I
get a blue screen. This does not happen if I have the EWF disabled.

I wonder if some of my settings are not correct. I am a bit dismayed at the
lack of documentation on how to use the EWF and examples of how it is used
successfully.

What determines how much RAM is used, is this set up ahead of time or does
it just take up the ram as it needs it?

David

 

[Slobodan Brcin]

Hi Doug,

The EWF works at the sector level. I think what this means is that worst
case you would need as much RAM as the size of the EWF protected partition.
In the real world, I doubt that you would change every sector of your
protected partition.

Exactly, worst case scenario.
But since you wont use defragmenter on drive with windows directory, you can
extract size of binaries from that math.

If in doubt, go with larger RAM since the machine will BSOD if the EWF runs
out of RAM.

If EWF don't BSOD, some other driver probably will.

Since nonpaged memory is scarce resource limited with max size, and other
drivers use this mem too even if you put 4GB of RAM it would not do any good
since EWF can't use it.

Regards,
Slobodan

 

[Slobodan Brcin]

Hi David,

Right now, I have maxed out my memory for my board (255MB)

What happened to 1MB of RAM?

When I try to copy 8mb onto my protected volume, part of the way through I
get a blue screen. This does not happen if I have the EWF disabled.

What special drivers you use not part of windows and board?
You might run out of continuous memory since nonpaged pool get fragmented.

I wonder if some of my settings are not correct. I am a bit dismayed at the
lack of documentation on how to use the EWF and examples of how it is used
successfully.

If it is protecting you partition, that it is working successfully.

What determines how much RAM is used, is this set up ahead of time or does
it just take up the ram as it needs it?

EWF uses nonpaged memory, as much as needed.

Don't copy files while protection is working.

Slobodan

 

[Andy Allred [MS]]

That doc has a typo, it's incorrect and I apologize for the inconvenience.
I'll work with the Doc team to get it fixed.
EWF w/ Ram Overlay doesn't require double the ram. Now, if you were trying
to load the entire runtime into RamDisk, then this may be correct, but from
the general description of EWF, this would not be correct. You can
build/deploy a runtime to disk (HD or CD) using EWF w/Ram Overlay with just
a few MBs of RAM allocated if you want.

Thanks

--
Andy

This posting is provided "AS IS" with no warranties, and confers no
rights.
=====================================================

 

[Doug Hoeffel]

Your settings are correct, plus there is not much to set for RAM-based EWF.

The BSOD you get is expected since you are out of RAM. The fact that the
copy works when the EWF is disabled is expected.

I believe that the RAM-based EWF consumes RAM as needed, ie. by writes to
the protected partition.

And yes you are correct... the EWF is a bit of a black hole. All I can
tell you is to test test test... ;-) which is exactly what you are doing.

HTH... Doug

 

[Andy Allred [MS]]

Sorry for not being too clear Slobodan, I was referring to the EWF partition
as set in the configurable UI of the EWF component.

Andy

 

[Dan Simpson [MS]]

This was an error on my part. I had mistakenly conflated the Remote Boot
RAM requirement with EWF RAM requirement. Many, many, many apologies about
that.

We are working to update this chat document as soon as possible.

We will also be providing updates in the online MSDN EWF documentation to
make things clearer.

Apologies,
Dan

 

[David D]

Glad to hear that.
Seems like by reading the newsgroup EWF and CF is a hot topic

David

 

[Dan Simpson [MS]]

It absolutely is. My sincere apologies for any confusion. I am working
towards improving the EWF sections in our docs to address many of the EWF
complaints brought up in the newsgroups, and this will certainly be one of
them.

Thanks for your feedback!

Dan

 

[Sean Liming \(eMVP\)]

David,

Let me jump in here. The 2x requirement is for Remote Boot, but the RAM
Overlay size is something to think about. The EWF rule for RAM Overlay is
that RAM Overlay size will grow to be the size of the volume your
protecting. 256MB CF implies that the RAM overlay can grow upto 256MB size.

Regards,

Sean Liming
www.a7eng.com
Author: Windows NT Embedded Step-By-Step and XP Embedded Advanced.

 

[Slobodan Brcin]

Hi Sean,

The EWF rule for RAM Overlay is
that RAM Overlay size will grow to be the size of the volume your
protecting. 256MB CF implies that the RAM overlay can grow upto 256MB

size.

And long before that happens you will run out of memory from nonpaged space
so your system will BSOD.

It is most precise to say that EWF RAM overlay size will reflect number of
changed sectors.
If nothing will try to write to CF then your overlay size is very small
bellow MB.

And you probably will not try to reorder all files on your CF, right?


Regards,
Slobodan

 

[David D]

Yes, no defragging
Now all that make sense and is how I expected it to be.
Ram size used in directly proportional to how much disk you try to write on
a protected volume. As you write more new stuff, RAM usage increases.

David

 

[Sean Liming \(eMVP\)]

Slobodan,

I haven't seen BSOD. Do you have the auto-defrag turned off?

Sean Liming

 

[Slobodan Brcin]

Sean,

I haven't seen BSOD. Do you have the auto-defrag turned off?

I haven't seen it either . But I'm guessing that is what will happen if
you ran out of memory.

Regards,
Slobodan