But it says nothing about registry entries. It also says its possible to flush contents on a nonboot VOLUME and not PARTITION.. although earlier it was talking about partitions. I really dont understand this stuff, but i understand the concern for EWF to protecting every volume in the system.
Protecting Multiple Volumes in a Hibernate Once/Resume Many Configuration
One of the limitations of implementing a Hibernate Once/Resume Many environment on your device is that all of the partitions on your system must be protected by EWF. Because the file system caches information about each partition on the system, that file system information is loaded when the system boots from the hibernation file. If a write is made to the system and that write is not captured in the hibernation file, the next time the system boots, the hibernation file will not match the contents of the partition and the system may become corrupt.
For example, on a system with two partition, C drive and D drive, you enable EWF. However, EWF is only enabled for C drive. D drive is not protected by EWF.
When you creates the hibernation file, information about the contents of C and D drives are included in the hibernation file. This is because the file system caches information about the attached volumes in the system.
When the system boots, it loads information in the hibernation file about both C and D drives.
You then delete several files from D drive. Because D drive is not protected by EWF, these files are deleted from the system.
The system reboots, and loads information from the hibernation file. Because the hibernation file still includes cached information about the contents of D drive, that information is loaded into RAM. Because the files that you deleted from D drive no longer exist in the system, the contents of the system's RAM and the contents of D drive do not match. There is now potential for the system to become corrupted. This is why EWF must protect all partitions in a Hibernate Once/Resume Many environment.
However, it is possible to flush the contents of a non-boot volume from system cache by unmounting the volume before you create the hibernation file.