Typical Amount of RAM Required for RAM-based EWF

ForEWF RAM-based overlays, writes made to your EWF-protected volume areredirected to RAM. The changes that are made to your protected volumeare not permanent and are lost when the computer restarts. You canretain the writes that were made to a volume when you commit your EWFoverlay. The amount of RAM that is required for RAM-based EWF depends onthe configuration of the run-time image. If you have applications inthe run-time image that are making a lot of writes to your protectedvolume, RAM consumption is high. Minimally, an EWF overlay requires onlya few megabytes of RAM. The maximum size of an EWF RAM overlay is thesize of the protected volume in addition to a small percent for overhead(less than one percent). The EWF RAM usage reaches maximum size if allsectors on the protected volume are overwritten in a single boot. Forbest results, monitor the writes of your applications and configure yourruntime to avoid all unnecessary writes.Keepin mind is that RAM is not preallocated by EWF. As your applicationsare making writes to the protected volume, EWF continues to use free RAMuntil it runs out of memory. If you have an application that is making alot of writes to your protected volume, EWF may use all of theavailable free memory. You will receive the following error message withthe next process that requires an allocation of RAM: Delayed Write Failed. Windows was unable to save all data for the file. The following list displays some of the methods that you can use to reduce the number of writes to the protected volume:Turnoff auto-defragment on the disk if you have the Disk DefragmenterCore/Disk Defragmenter for NTFS or the Disk Defragmenter for the FATcomponent in your runtime.Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Dfrg\BootOptimizeFunction
Name: Enable
Type: REG_SZ
Value: ( N =disable, Y =enable)
If the NTFS file system is not required on the system, use FAT because it minimizes the number of disk writes that occur.
If you need to use NTFS, consider using Compressed NTFS.
DisableNTFS Last Access Time logging (for only NTFS file systems). Updatingtimestamps can significantly decrease performance on the system. Add thefollowing registry value to your run-time image:Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem
Name: NtfsDisableLastAccessUpdate
Type: REG_DWORD
Value: ( 0 =disable, 1 =enable)This registry key stops the operating system from updating the last access timestamp every time that it accesses the hard drive.
Redirecttemporary files folders to an unprotected volume. By default, temporaryInternet files are stored in the %USERPROFILE%\Local Settings\TemporaryInternet Files folder. You can redirect these files to any folder on anunprotected volume by modifying the following registry key on yourrun-time image:Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Explorer\User Shell Folders -or-Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cache
Type: REG_EXPAND_SZ
Value: path_to_a_folder_on_an_unprotected_volume You can also redirect the TMP and TEMP folders to your unprotected volume by using the following registry settings:Key: HKEY_CURRENT_USER\Environment
Name: TEMP and TMP
Type: REG_SZ
Value: path_to_a_folder_on_an_unprotected_volume
Move the Event log files to an unprotected volume by editing the following registry keys:Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application
Name: File
Type: REG_EXPAND_SZ
Value: path_to_an_unprotected_volume\AppEvent.evt -and-Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Security
Name: File
Type: REG_EXPAND_SZ
Value: path_to_an_unprotected_volume\SecEvent.evt -and-Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\System
Name: File
Type: REG_EXPAND_SZ
Value: path_to_an_unprotected_volume\SysEvent.evt Thesetips are for informational purposes and are provided only as aconvenience. The entire risk of use or results in connection with theuse of these tips remains with the user.