EWF RAM Reg Mode
5/10/2007
EWF RAM Reg mode is similar to EWF RAM mode. It differs from the standard EWF RAM mode only in that the configuration information that is stored in the EWF volume is instead stored in the system's registry. EWF RAM Reg mode uses the following configuration:
- EWF Overlay is stored in RAM
- EWF volume is stored in the system's registry
The EWF RAM Reg overlay stores the write cache in RAM. When EWF RAM Reg mode is configured, EWF configuration is skipped during the First Boot Agent (FBA) process.
After FBA is complete, you must manually edit the system registry to enable EWF. No EWF volume is created on the system. EWF RAM mode supports only one overlay level.
Use RAM Reg mode in the following scenarios:
- Protecting media that has only a single partition, or media that cannot be partitioned
- Protecting removable media, such as CompactFlash, USB, or IEEE 1394 devices
- Protecting media that does not support standard RAM overlays
- Minimizing the number of write operations that are made to write-sensitive devices, such as CompactFlash
The following diagram shows an example of how EWF RAM Reg mode is configured on your device.
Because the EWF volume information is kept in the registry, if the registry is write-protected, attempts to disable EWF will fail. You must use the EWF Manager commitanddisable
command to commit the changes to the registry and disable EWF. For more information, see EWF Manager Commands.
If you are protecting more than one partition, you only need to commit the overlay to the partition where the Registry is stored. For example, if you had two protected partitions, C: and D:, you would use the EWF Manager command to disable the overlay on D:, and then commit the changes to the registry on C:.
ewfmgr d: -disable
ewfmgr c: -commit
For more information about configuring EWF RAM Reg mode, see Configuring EWF RAM Reg Mode.
You can also protect multiple volumes by using EWF RAM Reg modes. For more information, see Protecting Multiple Volumes By Using RAM Reg Mode.