Re: EWF with "Lazy write"

From: Slobodan Brcin \(eMVP\) (sbrcin_at_ptt.yu)
Date: 10/29/04 

Date: Fri, 29 Oct 2004 22:10:15 +0200

Doug,

> Sorry, I was going from memory (which is often faulty these days). I meant
> to say the "Use Less Overlay Space" setting for EWF should reduce its RAM
> usage, correct?

I have no idea how to use this option with registry configured RAM EWF.
Also idea behind this is that when every clump changes EWF will check its content to original content written on physical medium. In
case that they are same EWF will release some piece of memory.
This mean that if you have some file with zeroes in it (for instance) and then you write some data in it overlay mem usage will
increase, but if you write zeroes back to it then it will decrease.
Unfortunately this slows writes because instead of making only changes in RAM EWF need to read each clump from physical medium for
comparation.

So you would have much slower write performance, and I doubt that anything would change with real usage done by os and applications.

BTW: Does any one know if this option is working with RAM EWF and how to enable this option in reg config EWF?

Anyhow I wonder why MS choose to continue to force one component for both disk and ram based overlays since it is obvious that this
make real confusion to many developers.

Regards,
Slobodan