Speeding Up SSD-Based Netbooks and Adding Filesystem Integrity With EWFTool

Due to write amplification effect, write operations on flash memory can be quite slow, and negatively impact SSD lifetime. In order to make SSDs quick and last long, operating system should defer writing to flash memory device as long as possible (keep changes in RAM), and also avoid in-place rewrites of the single block.

This article explains how to protect SSD against wear-out using Enhanced Write Filter (EWF), how to speed up the slow SSD, and also how to establish rollback integrity filesystem in Windows XP.

1. Intended audience of this article

This article is for people who use SSD-based netbooks with Windows XP. Users choose SSD-based netbooks because are light-weight (~ 1 kg), energy efficient, cheap and robust to environmental impact like jolting.

They also can be pretty fast if one follows this article.

People usually install Windows XP to these computers, rather than Windows 7, as these machines tend to have not much RAM, and Windows XP is more tolerable to that limitation. Our tool FlashBoot has made easy to install of Windows XP from USB. This article, however, goes further and explains post-installation procedures required to speed up Windows XP on this kind of hardware.

2. Motivation: Limitations of Solid State Disks

Solid State Disks (SSDs) are superior to the traditional Hard Disk Drives (HDDs) in terms of power consumption, noise, and vibration resistance. They also have much better random access time.

SSDs, however, have some drawbacks compared to HDDs: higher price-per-gigabyte (it's OK for netbooks and likely to change in the future), and relatively low limit of writes per single block (and it's likely to stay forever).

Also SSDs have eraseblock larger than sector (typical ratio is 32:1), so each time sector is changed, entire eraseblock gets rewritten. This effect is called write amplification:

Due to write amplification, write operations on SSD can be slow, and also quite limited erase limit per eraseblock gets exhausted even quicker.

Conclusion: to make SSDs quick and last long, we must avoid writing changed data to them as long as possible (keep it in RAM). Also single block should not be repeatedly rewritten on the same place.

Windows XP repeatedly rewrites a lot of sectors belonging to filesystem metadata, filesystem integrity log, registry and registry integrity log. It makes a lot of scattered, non-localized writes per second. On SSDs they spawn mass block erases which eat up I/O speed and SSD lifetime. That's why we need additional measures to aggregate these writes in batches and hold transient changes in RAM.

3. What's EWF? How does it work?

EWF (Enhanced Write Filter) is a filter layer between disk and filesystem driver which is able to cache disk changes in RAM, and write them in batch. EWF can work in multiple modes, but for the purpose of this article we assume EWF working in RAM mode.

EWF is a part of Windows XP Embedded — special edition of Windows XP for information kiosks, ATMs and other similar devices where end user does not have an ability to install and run third party software.

EWF intercepts disk I/O requests right from the start of the operating system bootup and stores all changed pages in the RAM until complete OS shutdown. They are written to the disk all at once, just before poweroff or reboot.

During normal operation, nothing is written to EWFed disk at all, even if OS runs for hours or days. State of on-disk data always remains unchanged until everything is commited to disk in batch during scheduled reboot. With unscheduled reboot, i.e. using RESET button or by holding POWEROFF button for more than 5 seconds, you may revert to old snapshot of disk C:.

4. EWF installation instructions

1. Disable page file on disk C: if you have any (you can move it to another disk if you need it).

2. Download EWFTool and unzip it.

3. Run EWFTool and click "Install EWF Support".

4. Very important: if you are on XP SP3, you must replace C:\ntldr with ewfntldr_xp_sp3 from EWFTool.zip downloaded above, otherwise RAM space available for EWF overlay data will be very limited.

5. Reboot.

6. Add the following command to startup:

ewfmgr.exe -commit C:

7. Create New Shortcut:

8. Type "C:\Windows\SYSTEM32\ewfmgr.exe" or find this file in Browse... dialog:

9. Give some meaningful name to the shortcut, like "Schedule RAM to disk commit on shutdown" in this example:

10. Right-click new shortcut and choose Properties from the context menu:

11. Add "-commit C:" to Target field.

Also you may set option to run it minimized. Click OK.

Run that shortcut at least once before rebooting and then reboot. From now on, all changes to disk C: temporarily kept in RAM during the session will be commited to the disk on each reboot.

5. Drawbacks. Monitoring

EWF keeps all changes to disk C: in RAM, so you can have shortage of free memory if disk C: is actively changed in current session. To mitigate this issue, reboot each time after installation of large software to disk C:.

Also you can set up some monitoring tool to see how many RAM is consumed by EWF. To do this, create .CMD file with the following contents:

@echo off
cls
C:\Windows\System32\ewfmgr.exe C: | find "Memory used for data"
pause

6. Additional benefits from using EWF

Now your disk C: has full filesystem integrity. Changes to disk C: are accumulated and written in batch. If you reboot suddenly or have a BSOD, you'll never have to repair NTFS filesystem. If you've installed driver that didn't work, instead of rebooting and cluttering your filesystem and registry with unused files and entries, just hold POWER button for 5 second, or hard-reset your notebook, and in that way revert to previous state of disk C:.

7. Why netbooks and notebooks only?

Because commitment of changed pages to disk C: on shutdown is not atomic. Your PC has to be battery-backed, otherwise if power is lost on shutdown, a random part of session-changed pages will be written to disk C:, and other random part of them would be lost. Most probably, you'll have to reinstall Windows and applications on disk C: after such an event.