Hi Jim,
Take a look at the MSDN documentation for EWF RAM REG. EWF RAM REG usually
fits most peoples needs. To answer your questions specifically...
1) Are EWF partitions limited to 32MB?
If your talking about EWF RAM: EWF will protect the target partition
regardless of the size. Perhaps your confusing the configuration partition
with the protected partition? (BTW, the configuration partition is not
needed when using EWF RAM in REG mode)
If your talking about EWF DISK: The minimum overlay size is 32MB not the
maximum.
2) From some of the documentation it appears that the partition holds some
writes that can be committed later. If so which writes are these?
EWF RAM stores writes to the disk in a sector based overlay that is in RAM.
You can commit the overlay to disk for persistent storage using the EWFMGR
utility of the EWF API. The overlay stores all writes to the protected
partition. This is true for EWF DISK too, but the overlay is on the disk
instead of in RAM.
3) How does the page file, temporary files, event log, and registry writes
handled in an EWF environment?
In a system running EWF you don't want to include pagefile support since the
constant writes would consume all available space in the overly. You can
move the event log to another location that is not protected by EWF. Also,
in the Feature Pack 2007 is a version of a new EWF driver that is file
based. This means you can allow certain files (like registry dat files) to
be written through the overlay.
Here are some links to EWF documentation on MSDN:
EWF RAM REG:
http://msdn.microsoft.com/library/d...en-us/xpehelp/html/xegrfewframregoverlays.asp
EWF RAM:
http://msdn.microsoft.com/library/d...ry/en-us/xpehelp/html/xegrfEWFRAMOverlays.asp
EWF DISK:
http://msdn.microsoft.com/library/d...y/en-us/xpehelp/html/xegrfEWFDiskOverlays.asp
HTH,
Brad
