EWF Optimization Settings (XPe)
Overlay space usage
In all EWF modes, (RAM, RAM REG, and DISK) overlay space consumption is directly proportional to the number of unique writes performed by applications and the operating system. For example, repeated writes to the same sector do not increase the overlay space usage.
RAM and RAM REG modes
In these modes, EWF overlay is located in the physical memory, which means that writes are faster than writes to the disk. By using less overlay space you leave more physical memory for other applications. For example, if you gave up RAM mode or RAM REG mode because of physical memory shortage, you can now reconsider your scenario using one of these modes if you choose the Use Less Overlay Space option.
In this mode, overlay is located in the EWF partition on disk. Most devices have good storage capacity that a single user session does not exceed; however, you can select the Use Less Overlay Space option in this mode if necessary. For example, this optimization is useful on storage media that has a limited lifetime, such as Compact Flash (CF) or USB flash drives (UFD). You must weigh the overlay improvement against the longer write times that result from the extra reads that this optimization uses. For more information, see EWF Optimization Internals.
Tracking overlay space usage by using EWFMGR (all modes)
To determine whether these optimization settings are useful for your scenario you can measure overlay consumption with and without optimization enabled.
After you add the EWF component to your image and then deploy the image to your device, you can use the EWFMGR console application to control EWF. EWFMGR displays the overlay consumption caused by each protected volume. In the following figure, there are 32768 bytes of stored modified data and 4096 bytes of stored mapping information, which maps physical sectors to the overlay location.
Tracking overlay space usage by using EWF API (only for Disk mode)
For information, see the MSDN documentation for the EwfMgrGetProtectedVolumeConfig API.
Write requests from applications and the operating system translate to sector-level writes when they reach the EWF driver. If you do not enable optimization, EWF allocates space in the overlay for each of these sectors and writes to them. If you configure EWF to use less overlay space, it first reads the sectors into a temporary buffer and then compares them against the incoming writes. Then it allocates space in the overlay for the sectors which will be modified after the write, skipping the other sectors. The time saved depends on how many sectors are already in the overlay and how many sectors will be changed.