EWF RAM and RAM(Reg) Mode 續談 EWF

English
========================================================================

There are three different modes of EWF based on the different configurations for the EWF overlay and the EWF volume.

EWF Mode	EWF Overlay Location	EWF Volume Location	Description
Disk	On disk	Created on disk in unpartitioned space	EWF stores overlay information in a separate partition on the system. Because the overlay is stored in a nonvolatile location, the EWF overlay information can persist between reboots. Use EWF Disk types on a system if you want to maintain the state of the system. For more information, seeEWF Disk Mode.
RAM	In RAM	Created on disk in unpartitioned space	EWF stores overlay information in RAM. When the system is rebooted, all of the information in the overlay is discarded. Use EWF RAM types on systems if you want to discard any write information after reboot, or to delay writing the overlay to the media. For more information, seeEWF RAM Mode.
RAM Reg	In RAM	In system registry	Similar to EWF RAM types, RAM Reg overlays store overlay information in RAM. However, the configuration information about EWF is not stored in a separate EWF volume, but within the registry. Use EWF RAM Reg types on media that does not support changing the partition structure of the media, such as CompactFlash. CompactFlash media is typically marked as removable media. Removable media cannot be partitioned. For more information, seeCompactFlash Design Considerations. For more information, seeEWF RAM Reg Mode.

Reference by MSDN



中文
========================================================================
EWF 第二種 mode 為 RAM mode，此保護機制是使用把所有原本要寫到 HDD 內的修改，全部轉存在 RAM 上，由於 RAM 的特性，在系統斷電或是重新開機時，會清除 RAM 上的資料，藉此保持系統的安全與完整性。RAM mode的配置如下：
1. EWF 覆蓋層儲存於記憶體中
2. EWF volume 儲存於磁碟中

EWF RAM mode 所配置的 RAM 的大小，為非預先配置，因此 EWF RAM mode 能使用的 free 記憶體大小，最多為系統所剩下的 free 記憶體大小。


EWF 第三種 mode 為 RAM(Reg) mode，此保護機制與 RAM mode 相似，不同的地方為此 mode 把 EWF  volume 改存在系統的 Registry 中，因此 RAM(Reg) mode 的配置如下：
1. EWF 的覆蓋儲存於記憶體中
2. EWF volume 是儲存於注冊表中