Partager via

Configuring EWF RAM Mode

  • Article

5/10/2007

EWF RAM mode stores overlay data in system memory. Because the overlay is stored in RAM, your device may require additional RAM, depending on how many write operations are made to the system. Also, because the data cache is stored in volatile memory, the data cache is lost when the system reboots.

To configure EWF RAM mode

  1. If you are using FAT16 formatted media, you must use BootPrep to prepare the media. BootPrep updates the boot sector that MS-DOS generated. This allows the media to boot the Windows XP bootloader instead of the MS-DOS bootloader. For more information, see BootPrep. If you are deploying to an NTFS or FAT32-formatted CompactFlash file system, you do not need to use BootPrep.

  2. Create a working configuration by using Target Designer. To create a configuration, follow the steps that are provided in Tutorial: Building and Deploying a Run-Time Image.

  3. Add the following components to your configuration:

    • Background Disk Defragmentation Disable
    • Enhanced Write Filter
    • EWF Manager Console Application
    • EWF NTLDR

  4. Expand the Enhanced Write Filter node in the configuration browser pane and select Settings. The EWF Configuration Settings appear in the details pane.

  5. Change the following default settings for Enhanced Write Filter:

    • Set the EWF Partition size to 0 KB.
    • Select the Start EWF Enabled check box.
    • In the Disk Number field, type the disk number that contains the volume that you want to protect.
    • In the Partition Number field, type the partition number for the volume that you want to protect.
    • Set the Overlay Type to RAM.

  6. Add command-line support to your run-time image. If you are using the Explorer shell, enable support for the Run command on the Start menu:

    1. Expand the User Interface Core component in the configuration browser and choose Settings. The User Interface Core settings appear in the details pane.
    2. Select Show Run on Start Menu.

  7. Check dependencies and build the run-time image.

    1. Choose Check Dependencies from the Configuration menu. Resolve missing dependencies.
    2. Build the run-time image. Choose Build Target Image from the Configuration menu.

  8. Ensure that there is additional space on the media that you plan to deploy your run-time image to. During the FBA phase, EWF creates the EWF volume on the media that will contain metadata information on the EWF configuration.

    The media that you deploy to cannot have more than 3 partitions, and must support partitioning.

  9. Deploy the run-time image and boot the device. During the FBA phase, Ewfdll.dll reads the configuration parameters from the registry.

    Ewfdll.dll creates the EWF volume, and formats it according to the EWF configuration parameters. The EWF volume has no drive letter assigned to it and is not visible to the user. Only the EWF master volume table, which can be as small as 64 KB, is saved to the EWF volume.

    The EWF configuration information in the EWF volume is then copied to the registry, and the system reboots. After the final FBA reboot, EWF searches for the EWF volume on the local computer.

    If the EWF volume is detected, it is inspected by EWF. EWF then configures itself and executes any pending EWF commands in the volume, such as the commit command. If no EWF volume is found, EWF disables itself.

  10. After the FBA process completes, reboot the system. Verify that EWF is properly configured by typing the following command from a command prompt:

    ewfmgr c:

    ewfmgr should report that EWF is enabled and provide a current status of the EWF RAM overlay.

  1. If you are using FAT16 formatted media, you must use BootPrep to prepare the media. BootPrep updates the boot sector that MS-DOS generated. This allows the media to boot the Windows XP bootloader instead of the MS-DOS bootloader. For more information, see BootPrep. If you are deploying to an NTFS or FAT32-formatted CompactFlash file system, you do not need to use BootPrep.

  2. Create a working configuration by using Target Designer. To create a configuration, follow the steps that are provided in Tutorial: Building and Deploying a Run-Time Image.

  3. Add the following components to your configuration:

    • Background Disk Defragmentation Disable
    • Enhanced Write Filter
    • EWF Manager Console Application
    • EWF NTLDR

  4. Expand the Enhanced Write Filter node in the configuration browser pane and select Settings. The EWF Configuration Settings appear in the details pane.

  5. Change the following default settings for Enhanced Write Filter:

    • Set the EWF Partition size to 0 KB.
    • Select the Start EWF Enabled check box.
    • In the Disk Number field, type the disk number that contains the volume that you want to protect.
    • In the Partition Number field, type the partition number for the volume that you want to protect.
    • Set the Overlay Type to RAM.

  6. Add command-line support to your run-time image. If you are using the Explorer shell, enable support for the Run command on the Start menu:

    1. Expand the User Interface Core component in the configuration browser and choose Settings. The User Interface Core settings appear in the details pane.
    2. Select Show Run on Start Menu.

  7. Check dependencies and build the run-time image.

    1. Choose Check Dependencies from the Configuration menu. Resolve missing dependencies.
    2. Build the run-time image. Choose Build Target Image from the Configuration menu.

  8. Ensure that there is additional space on the media that you plan to deploy your run-time image to. During the FBA phase, EWF creates the EWF volume on the media that will contain metadata information on the EWF configuration.

    The media that you deploy to cannot have more than 3 partitions, and must support partitioning.

  9. Deploy the run-time image and boot the device. During the FBA phase, Ewfdll.dll reads the configuration parameters from the registry.

    Ewfdll.dll creates the EWF volume, and formats it according to the EWF configuration parameters. The EWF volume has no drive letter assigned to it and is not visible to the user. Only the EWF master volume table, which can be as small as 64 KB, is saved to the EWF volume.

    The EWF configuration information in the EWF volume is then copied to the registry, and the system reboots. After the final FBA reboot, EWF searches for the EWF volume on the local computer.

    If the EWF volume is detected, it is inspected by EWF. EWF then configures itself and executes any pending EWF commands in the volume, such as the commit command. If no EWF volume is found, EWF disables itself.

  10. After the FBA process completes, reboot the system. Verify that EWF is properly configured by typing the following command from a command prompt:

    ewfmgr c:

    ewfmgr should report that EWF is enabled and provide a current status of the EWF RAM overlay.

See Also

Other Resources

EWF Modes
Troubleshooting Enhanced Write Filter
EWF Performance Considerations