哪种ewf模式使用CF？ [英] which ewf mode using CF?

问题描述

您好，

我是XP Embedded的新手，我对EWF有一些疑问。

我创建了用于CF卡的XP嵌入式映像。我想保护CF卡免受EWF的写访问。但是我应该使用哪种模式。

RAM模式/ RAM Reg模式：

这种模式的问题是，目标计算机将在没有重启的情况下运行大约半年，因此EWF覆盖将需要更早或更晚的整个RAM。

如果RAM已满，该怎么办？

磁盘模式：

，EWF Overlay位于CF卡上有一个额外的分区，对吗？

那么，如果每个写访问权仍然写在CF上，那么EWF的优势在哪里？

谢谢

Richard

解决方案

Richard，

您对磁盘模式的看法是正确的 - 对于只有CF的系统来说它似乎没用多少。

关于RAM / RAM寄存器模式：

- 将消耗的RAM量等于分区上已更改扇区的数量。因此，对于具有大量静态文件（例如OS文件）且只有少量空间的系统，系统将仅在分区上的扇区改变时消耗RAM。写入新文件或修改和写入文件时会发生这种情况。
对于静态文件，不会消耗任何RAM。

这是一个例子：在一个512 MB的分区上，操作系统映像大约为300MB，EWF RAM的使用量最多可能是212MB（可写入的可用空间）加上一定比例的操作系统文件（占300MB的25％，或75MB），使您从EWF的最大RAM使用量约为287MB。

当然，这些数字可能差异很大。您可能不会写入CF上的每个空扇区，并且操作系统可能会因更改而使用更多或更少的RAM。

如果RAM用完了，就会发生不好的事情。尽可能避免这种情况。

有些选项可以避免RAM耗尽：
1。编写一个程序，使用EWF API监视RAM使用情况，并将覆盖层刷新到磁盘或在系统紧张时重新启动系统。
2。使用Feature Pack 2007的基于文件的写过滤器（FBWF），它是基于文件的过滤器而不是基于扇区的过滤器。这允许您指定"直写"文件，例如注册表，并具有更好的内存管理功能。它将压缩RAM中的覆盖信息，并在不再需要时恢复内存。搜索结果的问候，结果，德斯结果

Hello,

i am a newbie to XP Embedded and I have some questions about EWF.

I created a XP Embedded Image for a CF-Card. I want to protect the CF-Card from write access with EWF. But which mode should i use.

RAM Mode / RAM Reg Mode:

the problem with this modes is, that the Target Computer will run about half a year without a reboot, so the EWF Overlay will require the whole RAM earlier or later.

And what if the RAM is full?

Disk Mode:

in disk mode, the EWF Overlay is located on an additional partition on the CF Card, right?

So, where is the Advantage of EWF, if every write access is still written on CF?

thanks

Richard

解决方案

Richard,

You are correct about the disk mode - it doesn't seem to have much use for a system that only has CF.

Regarding RAM / RAM Reg mode:

- The amount of RAM that will be consumed is equal to the amount of changed sectors on the partition. Thus, for systems that have a lot of static files (Such as OS files), and only a small amount of space, the system will only consume RAM when a sector on the partition is changed. This would happen when a new file is written, or when a file is modified and written.
For the files that are static, no RAM will be consumed.

Here's an example: On a 512 MB partition, where the OS image is ~300MB, the EWF RAM consumption will probably use a maximum of 212MB (Free space that could be written to) plus some percentage of the OS Files (Say 25% of 300MB, or 75MB), giving you a max RAM usage from EWF of around 287MB.

Of course, these numbers could vary widely. You probably won't write to every empty sector on the CF, and the OS may use more or less RAM due to changes.

If you run out of RAM, bad things will happen. Avoid this scenario if at all possible.

Some options that you have to avoid RAM depletion:
1. Write a program that uses the EWF API to monitor RAM usage, and flush the overlay to disk or reboot the system when it gets tight.
2. Use Feature Pack 2007's File Based Write Filter (FBWF), which is a file-based filter rather than a sector based one. This allows you to specify files that are "write-through", such as the registry, and has better memory management capabilities. It will compress the overlay information in RAM, and will recover memory once it no longer needs it.

Regards,
Desi

这篇关于哪种ewf模式使用CF？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！