i'm currently trying my 11th nlited xp windows install. I'll try this out and post my results.
Does this 1KB write occur even with EWF on?
Okay, after knubile posted the MSDN article on the bootstat.dat file and the bootup recovery options I investigated a little and found that if we simply delete the bootstat.dat file the recovery message doesn't come up. Another interesting side effect of this is that XP no longer performs that single write operation during bootup. Using VirtualPC or VMWare you can see the OS performs a small (1KB) write operation right before the GUI starts up. It seems this may have something to do with the bootstat.dat file because so far my VirtualPC install no longer does that! This has two advantages: 1) less writes is always good on CF drives, and 2) this could potentially improve boot up times even more since writes tend to be very slow on CF cards. I'm at work right now, so I can't test this on my CF install so I can't be sure.
All you need to do is disable EWF, delete the bootstat.dat file in C:\Windows, enable EWF, reboot.
Yeah, the 1KB write occurs below EWF so it can't be filtered (kind of like hibernation). It doesn't occur with the bootstat.dat file removed so I'm assuming that file is what is being written.