Using the a temp drive on a protected EWF drive.

  • Thread starter Thread starter TEX
  • Start date Start date
T

TEX

Have found that when an overlayed drive is filled with a large quantity
of files and then deleted then the space cannot be recovered without
rebooting. Although the recycle bin shows empty, running ewfmgr shows
the overlay still has files to be written.

We are using a overlay to protect a drive that has an image to write
dvd's. Problem is that after a dvd is written (utilising a pre allocated
space of 4.7gb)...you are stuffed since you can't recover the space the
temp dvd image file has used.

Other alternatives of a ram drive is not possible.

Is there other solutions??? Comments welcome.

Thanks

TEX
 
Have found that when an overlayed drive is filled with a large quantity
of files and then deleted then the space cannot be recovered without
rebooting. Although the recycle bin shows empty, running ewfmgr shows
the overlay still has files to be written.
Click to expand...

You are 100% correct about this, since EWF protect whole partition without
knowing the file system on this partition, it is logical that it have no
idea about your attempt to delete some files, since EWF does not know
anything about files, only about changed sectors on protected partition.
We are using a overlay to protect a drive that has an image to write
dvd's. Problem is that after a dvd is written (utilising a pre allocated
space of 4.7gb)...you are stuffed since you can't recover the space the
temp dvd image file has used.
Click to expand...

This is interesting approach, would you like to give us some hint why did
you protected temporary storage partition?
What do you expect to gain by this?

When you write data to this partition, all changes go to EWF overlay
partition. So HDD is not saved from writes, they are merely reallocated.

You should not protect temporary partition that you are using for DVD
content creation.

Regards,
Slobodan
 
Slobodan said:
You are 100% correct about this, since EWF protect whole partition without
knowing the file system on this partition, it is logical that it have no
idea about your attempt to delete some files, since EWF does not know
anything about files, only about changed sectors on protected partition.




This is interesting approach, would you like to give us some hint why did
you protected temporary storage partition?
What do you expect to gain by this?
Click to expand...

Just how I was asked to do it. Stupid I thought. Firstly the system
writes and deletes from the system drive, requires the use of a temp
folder to write DVDs and the swap file is also set to the system drive.
This is silly since every write/delete is allocating space and then
unable to recover the space until a commit is applied.

When you write data to this partition, all changes go to EWF overlay
partition. So HDD is not saved from writes, they are merely reallocated.

You should not protect temporary partition that you are using for DVD
content creation.

Regards,
Slobodan
Click to expand...
I was trying to find alternative solutions since ewf relies on the use
on basic disks, and max number of partitions is 4 per basic disk, and we
already have 3.

TEX
 
I don't understand your reply, but....
You can reallocate paths to those folders to other partition, by modifying
registry.

Regards,
Slobodan
 
I was trying to find alternative solutions since ewf relies on the use
on basic disks, and max number of partitions is 4 per basic disk, and we
already have 3.
Click to expand...

It is true that EWF requires basic disks, but basic disks do not have a
limit of 4 partitions. Perhaps the limit you are talking about is the limit
of 4 primary partitions?

The EWF partition can be in a logical partition in an extended partition.
The only caveat is that if you use an extended partition, make sure you
leave the free space that EWF is supposed to use for the EWF partition
within the extended partition (preferably at the end of the extended
partition.) EWF will then create a logical partition within the extended
partition as it initializes during FBA.

If you use an extended partition, but don't put the free space in the
extended partition, EWF will not be able to allocate any space.
This is silly since every write/delete is allocating space and then
unable to recover the space until a commit is applied.
Click to expand...

As Slobodan mentioned, EWF doesn't know anything about allocation/frees,
because it only sees sector level I/O. However, that doesn't mean those
sectors are lost without a commit, because the file system will at some
point get around to reusing those sectors. My best guess is that the file
system keeps track of a last known free pointer for the disk and keeps
walking forward from that point as it allocates new space. Assuming that is
true, resetting that last known free pointer would solve your problem. The
problem then is how to reset that pointer, and again my best guess is that
restarting the computer does it automatically. However, that doesn't really
solve your problem, but it does lead to the following observation that may
help.

For disk based volumes, I'd say a minimum size for the EWF partition should
be the amount of free space found on the protected volume, plus some
percentage of the total size of the volume based on your embedded scenario.
(Don't forget to add in space for the EWF partition to cover the swap file
if it is on the protected volume.) Therefore, one way to fix your problem
would be to limit the amount of free space on the protected volume, such
that the system is forced to re-use sectors shortly after it reaches its
peak space usage and deletes files to reclaim space.
 
Back
Top