Using EWF on regular WinXP - Page 8

knubile · 12-04-2004, 10:14 AM

I just went over the whole process this morning on my system using a 1G partition on a laptop drive. All works well. The document is accurate. I have those registry settings in a few reg file, so it's as easy as a double-click. I'll post those soon.
I kind of have a EWF Kit going right now with all the reg files, ewf files, and a few batch files to enable/disable etc, just for convenience. I'll zip all of these up and post them soon.

knubile · 12-04-2004, 10:17 AM

I got too eager and ordered a 1G Lexar 80X CF card yesterday. I'll have it by Monday. I'll be copying my OS partition from the laptop drive to it and testing all of this EWF stuff out. I'll continue to add to the doc.
Keep me posted with your results SFiorito, hopefully it works out straight forward for both os us.

Does anyone know of an application that can tell you how much data has actually been written to a drive. One that won't be tricked by EWF. I want to track exactly how many writes are happening to my CF card.

knubile · 12-04-2004, 10:29 AM

Here's something interesting. Here are the steps I took. My system is a Hibernate once resume many system with EWF enabled.

1. Create a text file on the desktop.
2. Reboot. The text file is gone.
3. Create the text file again.
4. Hibernate. This saves the new hiberfil.sys which it will resume from from now on.
5. Resume. The text file is still there.
6. Shutdown.
7. Turn on the system. It resumes from the hiberfil.sys file. The text file is still there!
8. Now reboot and hit F8 during the resuming progress bar and select the option to delete the restore information and go to the boot menu.
9. Select the normal startup. The text file is gone!

So it seems like you can hang on to files that would normally be lost due to EWF by freezing the system in that state with hibernate. When you don't want it anymore, reboot, and they will be gone.

This may be handy if you want to try a new app for a few days. Install it with EWF enabled, then hibernate. Resume from that state file over the next few days to try out your new app. If you don't like it, hit F8 on the next resume and kill the restoration data. Voila! You're back to where you were a few days ago.

This means the entire application is stored in memory the whole time, but man, that's so cool!

I tried the same thing with settings in FrodoPlayer. The new settings lasted through all the resumes after I hibernated once. As soon as I deleted the restoration data, it was back to the original settings.

knubile · 12-04-2004, 10:31 AM

So, is a hibernate once resume many system and HORM system? That's so much easier than typing the whole thing out.

SFiorito · 12-04-2004, 10:34 AM

Use the performance log under Admin Tools. Use the write values under PhysicalDisk. Test it by creating and deleting some files with EWF enabled and the values won't register any writes. Then run -commitanddisable -live. Do the same test again and you'll see it write. My CF card should be here Monday so we'll see.

Yeah, HORM is what MSDN uses to refer to hibernate once resume many. It makes sense since the RAM overlay will be saved with a hibernate, but I don't know if you'd want to hibernate every time you shut off since you'll be writing to the CF disk every time.

I think the FrontEnds should have configurable locations for their database files, resume files, etc. Either that or just install it on the external drive.

knubile · 12-04-2004, 10:44 AM

Quote:

I think the FrontEnds should have configurable locations for their database files, resume files, etc. Either that or just install it on the external drive.

I totally agree. Too bad the front ends on this forum aren't open source. I put in a request for FrodoPlayer, but Frodo's been in a car accident, so I'm sure he wants to rest up.

SFiorito · 12-04-2004, 10:54 AM

What I'm thinking for my setup is that the system should run fine even without the external drive. So GPS, FM, XM, and DVD will still work. Just no MP3's or MPEG's. Then I would have a harddrive MP3 player with USB connection and that would act as my external drive. That way I only need to keep my music files on one device. Ideally, the frontend should identify when you connect a new removable device and either ask you or automagically search the drive for files and store the DB on the root of the device. When you reconnect a device that has already been "initialized" by the frontend it'll just load the DB from that device. It's just a thought for right now, but that's what I'd like my system to do. Unfortunately my 2.5" drive went to **** so I had to send it to hitachi to get it fixed.

knubile · 12-04-2004, 11:47 AM

That's a pretty good idea.
Have a db file at the root of the folder for the media. When the frontend finds that db, load it. That way you won't have all these songs on your screen when you don't have the files. Good thinking.
Frodo? any other front end devs? You'll be my hero if you implement this.

camsgs3 · 12-05-2004, 10:57 PM

so once you hibernate for the first time - it will always resume from that point. correct?? so what happens when i shut down my carpc will playing a song in frodo, it wont resume from that point?

SFiorito · 12-05-2004, 11:21 PM

Using HORM (hibernate once, resume many) you're creating a snapshot and you'll always resume to that point (unless you hibernate again). Now, if you install frodoplayer on a writeable drive then I guess it should resume the song. I'm not sure how frodoplayer works, but in Windows you can capture the resume power event so then your app can decide what to do. I'm guessing frodoplayer captures that event and reads from its config what it was doing before shutdown. I don't know, I'm just guessing. This is something we'll have to test. I'm currently working on another XPe component (besides minlogon) so I haven't had much time to mess with any frontends using minlogon and EWF.

msb5150 · 12-06-2004, 09:32 AM

Researching EWF at school, I found this
Useful for controlling EWF programatically, through the API's. In this page I found the source code to the ewfmgr (or something extremely similar) Along with the (Visual Studio .NET 2k3) code to check the status and information of EWF protected volumes.

SFiorito · 12-06-2004, 10:51 AM

Yeah, I actually mentioned that briefly in one of my first posts. One of the things I need to research is the ability to commit a single file. I think EWF can do this without disabling protection, so this may be the answer to frontend config files. But I need to look into it a bit more. If this does work then frontend's could support EWF by using the EWFAPI to save their config files before shutdown.

CombatCQB · 12-06-2004, 11:17 PM

Two questions about HORM: After implementing HORM, does that mean I can cut power to the PC at any time and it'll still resume as if everything was just fine?

Also, reading the design considerations for EWF here:
http://msdn.microsoft.com/library/de...ibernation.asp
It states that HORM can cause inconsistances with volumes not protected by EWF since any changes to those volumes won't be recorded at the next resume. So after a few updates to a media HD for example, one should re-hibernate to keep the hiberfil.sys up to date?

SFiorito · 12-06-2004, 11:33 PM

Yes, with HORM you can just switch it on and off as you like. That's how I've been running my system. I haven't seen any of those problems they're talking about. I think if you disable write caching you're fine. It's kind of like when XP complains that you unplug a removable drive without using their little "Safely remove device" applet. That's so it flushes the buffer to the drive, but if you disable caching it's not a problem. Just go to drive properties, hardware, properties, profiles (i think that's what it is), and select quick removal option. I don't plan to do much writing to my usb drive in the car so I don't think it'll be a problem for me.

SFiorito · 12-07-2004, 06:21 PM

Hey guys... I got my CF card last night and started working to install my OS on it. After spending all last night and most of today fighting with it, it seems that my CF->IDE adapter is a POS (piece of ****). DAMN!!! I've been able to boot to DOS using a USB card reader (damn fast too!!), but this IDE adapter is just completely random. It'll work one time, not the next, slow the system to a crawl, cause hard crashes, all kinds of good stuff. I ordered another adapter from logic supply over night. I hope it gets here tomorrow!!!