ram reg模式下的EWF保护ramdisk（0）？ [英] EWF in ram reg mode protecting ramdisk(0)?

问题描述

这可能听起来很愚蠢，但请坚持下去。

对于WinPE，写入缓存由fbwf处理。是否有可能在WinPE中用EWF替换FBWF（比如输入VolumeID = ramdisk（0））？

为什么它不起作用的原因是什么？
我昨天尝试过，但是在ntfs.sys上有错误的BSOD。

约阿希姆

解决方案

常规卷，类guid = {71A27CDD-812A-11D0-BEC7-08002BE2092F}，由volmgr.sys管理。 EWF是此设备类的过滤器驱动程序。相比之下，Ramdisk卷的类guid = {9D6D66A6-0B0C-4563-9077-A0E9A7955AE4}并完全由ramdisk.sys管理。指向ramdisk卷的I / O直接由文件系统发送到ram磁盘驱动程序。 Volmgr或其任何过滤器都没有任何作用。因此，您无法使用EWF过滤ramdisk I / O.

FBWF是一个文件系统迷你滤波器，并且不知道存在的音量驱动器。因此，它可以过滤两种卷。

在任何情况下，您打算通过过滤ramdisk卷来实现什么？

感谢
SRIKANTH

It may sound rather stupid, but hang on to this one.

For WinPE the writecache is handled by the fbwf. Could it be possible to replace FBWF with EWF in WinPE (like putting VolumeID = ramdisk(0))?

What could the reason be why it would not work?
I tried yesterday, but BSOD with errors on ntfs.sys.


Joakim

解决方案

Regular volumes, class guid = {71A27CDD-812A-11D0-BEC7-08002BE2092F}, are managed by volmgr.sys. EWF is filter driver for this device class. In contrast, Ramdisk volumes have class guid = {9D6D66A6-0B0C-4563-9077-A0E9A7955AE4} and are entirely managed by ramdisk.sys.  I/O directed towards a ramdisk volume is sent to the ram disk driver directly by the file system. Volmgr or any of its filters have no role to play in this. Consequently you cannot filter ramdisk I/O using EWF.

FBWF however is a file system mini filter and is agnostic of the volume driver present. Hence it can filter both kinds of volumes.

In any case, what do you intend to achieve by filtering the ramdisk volume ? 

Thanks
Srikanth

这篇关于ram reg模式下的EWF保护ramdisk（0）？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！