Intellaworks: read the document linked at the beginning of this thread...
Jackboot: all writes are disabled to the drive as long as ewf is enabled (unless you start using extremely lowlevel system calls to write to the disk, but in general all writes are disabled). the memory usage is how much ram your disk overlay is taking up. remember: all writes are stored in memory by ewf while the system is running. when you reboot it either loses that data or, if you decide to commit it (ewfmgr c: -commit) then it saves it do disk.