ewfmgr

  • Thread starter Thread starter Frank
  • Start date Start date
F

Frank

Hello,
I use ewfmgr with memory mapping. When I ask for the ewfmgr info it states:
memory used for data xxxxx bytes. At some moment all memory will be used for
this mapping. But which data is mapped into the area? When I used filemon I
don't see any activity on the C disk. That's logical because nothing is
written to the disk but to memory? But how then can I determine what data is
written. It only fills up slowly, about a 100K/day.
Thanks
Frank
 
Hi Frank. EWF literally stores all write operations at the basic I/O level
to the overlay - it doesn't have any innate awareness of the actual data
being written, but rather it writes all raw data that would otherwise be
written to the protected volume. It is not possible (through any supported
method, anyway) to see the map of data in the overlay.

If you're managing to get your overlay growth down to 100K per day, you're
doing very well - it's very difficult to get Windows to stop writing to its
system files and the registry, so paring it down to the minimum possible
output is quite a challenge.
 
Hi Frank. EWF literally stores all write operations at the basic I/O level
to the overlay - it doesn't have any innate awareness of the actual data
being written, but rather it writes all raw data that would otherwise be
written to the protected volume. It is not possible (through any supported
method, anyway) to see the map of data in the overlay.

If you're managing to get your overlay growth down to 100K per day, you're
doing very well - it's very difficult to get Windows to stop writing to its
system files and the registry, so paring it down to the minimum possible
output is quite a challenge.
 
Frank,

I suppose you are talking about RAM (or RAM Reg) mode of EWF.

As Matt pointed out, you are doing good if your EWF usage grows only by 100K per day.

There is currently no way to query or control EWF about how it allocates the memory. There is no even a way to set the limit. (vs
FBWF which has the feature)

Just so that you can think more about how to minimize unintentional EWF RAM usage:
http://msdn2.microsoft.com/en-us/embedded/aa731207.aspx
 
Thanks for your answers.
Frank

KM said:
Frank,

I suppose you are talking about RAM (or RAM Reg) mode of EWF.

As Matt pointed out, you are doing good if your EWF usage grows only by
100K per day.

There is currently no way to query or control EWF about how it allocates
the memory. There is no even a way to set the limit. (vs FBWF which has
the feature)

Just so that you can think more about how to minimize unintentional EWF
RAM usage: http://msdn2.microsoft.com/en-us/embedded/aa731207.aspx
Click to expand...
 
Back
Top