Accelerating the reaction of Windows XP / 7. Careful use of SSD drives
Read the topic "Do you have 2-3 HDD? Let's speed up the loading and reaction of Windows and programs ”, which encouraged me to talk about my method of speeding up Windows. The beginning was the acquisition of the TS16GSSD25S-S SSLC SLC disk and 4GB of memory (at that time I had WinXP 32bit) and the desire to squeeze the maximum out of the system. This method was tested by me for six months on XP and the same on 7.
1. Protecting the SSD disk (there are a lot of opinions about their "survivability", if you put the Windows and the paging file on them);
2. Accelerating the reaction of Windows to user actions;
3. Acceleration of applications and system services;
4. Use of memory over 3GB (in case the Windows do not see it).
1. The main tool EWF (Enhanced Write Filter - advanced write filter).
It is included with Windows XP Embedded. The main functions of the module are deferred recording to disk (all changed data is saved on the HDD at the same time when you log out or at the command of the user) and “freeze system state” (any recording on the disk is prohibited, every time the PC is turned on, the system has a status at the time the function is activated) . There are many descriptions and examples of using EWF in the network (for example, you can download the program and software that controls the operating modes of EWF, I didn’t see the new version of EWF from Win7 on the network, I can put it) Pros and cons of this module:
2. Method - transfer TEMP files to RAM disk.
Reassign the path of the TMP and TEMP environment variables to the RAM disk (System Properties - Advanced - Environment Variables). The Windows / TEMP and Documents and Settings \ "User" \ Local Settings \ Temp \ folders should be replaced with links to the TEMP folder in the RAM disk (this can be done by simply creating a folder shortcut or creating a "symbolic link" with third-party tools, for example, described here ). I don’t presume to do it correctly. I spent little time on this issue, but everything worked fine for me. Links should be made only for "crookedly written" programs that assume the TEMP directory exclusively in the Windows folder. Pros and cons of the method:
3. Method - transfer the SWAP file to the RAM disk.
By standard means, it is possible to transfer the paging file to another disk, but I ran into a problem when, at the start of the RAM system, the disk is picked up after the SWAP file is picked up. As a result, Windows itself creates a resizable file on the disk with the system. The output I found is the addswap.exe program (as part of the Gavotte RAMDisk utility), which allows you to “pick up” the paging file after the system has started (in fact, it is recreated every time the system starts), and you can create the file not in the root, but by of the way. It is necessary to run it only once. Questionable opinions about the fact that the C drive must have a paging file, even if the minimum size (something there with memory dumps during the collapse of programs, etc.), as well as the opinion that without it the system works almost better (I still don’t trust Windows, even the seven, and try to keep a small 500-1000MB swap file in the system, it’s still in memory, but I always recommend using the “fixed” swap file size). Pros and cons of the method:
4. Tools - create a RAM disk in unused OS memory.
Suppose we have a 32bit Windows, 4GB of RAM installed, and the motherboard BIOS supports them. The OS usually sees 3 ... 3.5GB of RAM, the rest remains inaccessible (the PAE key in boot.ini did not help in my case). I know 2 programs that could create a RAM disk in inaccessible memory - SuperSpeed RamDisk Plus and Gavotte RAMDisk. The first one is quite “heavy”, it saves data from the RAM disk when shutting down, and restores them at system startup, but does not hook up the paging file (the RAM disk is mounted too late at system start). The second is simple and not whimsical, it has the ability to work through the command line, you can save data manually (or by writing bat files for autoloading), the main advantage is that I managed to install a paging file on it so that when the system started it would pick up on its own (but this happens a bit crooked - in the settings of the paging file in the OS, this SWAP file is not visible, but the total SWAP volume is indicated correctly). Both programs can create a TEMP folder when mounting a disk (conveniently if you use the “do not save data when you turn off the computer” mode). And one more noticeable minus of SuperSpeed - let's say you use “save data on shutdown”, if the disk is 100 MB full, then it’s logical that the image file of this disk will be comparable, BUT if you ever filled the disk with 300 MB, then the disk image will never be Smaller (even remove all data from the RAM disk), only the re-creation of the disk helps.
')
5. Method - do not store personal data on the disk with the system and even more so on the desktop.
All "My Documents", movies, photos, etc. I advise you to keep NOT on the system partition of the disk. You can call the reason for the slowdown, especially when it is objectively stored on the desktop, but the main reason is data integrity. Personally, I have long since switched to using the server at home - all the data in the family is stored there, it is secure and allows access to it from any computer, laptop and PDA. It is always on, always available, and when asked why keep the server just for this - I have a NAS server only a fraction of the capabilities it has implemented. In connection with the problem of inaccessibility of data "outside the home" - I believe you will come up with a solution (my solution is a VPN connection, and no more than 10 files on the laptop / pc with you). There is still a feeling of “impunity”, I remember sweating in 96g then, realizing that an important hard disk section had collapsed, now I vyzalyatsya over Windows as I want, with confidence that with the problem I will restore it from Acronis image in 10 minutes (on the same server about 10 images on different computers and laptops and with different operating systems for them). Another plus is that 16GB of hard drive is enough for me to work under Win7.
6. Method - transfer user folders to RAM disk.
Don't hit hard - I had reasons to do that. At first I turned on EWF mode on the system disk, after some time I began to miss the 512MB buffer for comfortable work (I had to reboot the computer once every 1-2 days, and usually it was in my “sleep mode” for weeks and extremely seldom). After analyzing which files change most often (otzhiraya while EWF buffer) came to the conclusion that it is to a lesser extent the files of Windows in the WINDOWS and Program Files folders and to a large extent the current user folder. It was decided to post a user folder (two users in my case) and Windows / programs files to different disks.
The minimum program is to make 2 logical disks - on the first Windows, on the second two folders of users from Documents and Settings. For each disk, enable EWF, thereby increasing the total maximum buffer to 1GB.
The maximum program is to transfer the user's folder to the saved RAM disk - we get a very decent increase in speed, but you need to save the image of this disk to a section WITHOUT EWF, and that is the risk of overflowing the buffer and getting stuck when the system reboots while saving the RAM disk image. Advantages and disadvantages:
7. Method - the correct layout SSD drive.
The problem is quite logical when a logical block of data (equal, for example, to one physical block on a disk) is located on a disk with an offset. The consequence of this is that when reading / writing one logical block of data, work happens with “two halves”, and in fact with two physical blocks on the disk. In theory, when formatting a disk under Win7, such problems should not arise, but it is advisable to check it all the same, for example, using the Paragon Alignment Tool.
So, we take a picture of the universe and stupidly see what's what ...
I will try to more clearly describe what I got and the sequence of actions to achieve this.
The disk structure should be the following:
real partitions or disks (NTFS)
C: - preferably the first one on a fast disk, it has a Windows (minus the TEMP folder and user folders from Documents and Settings) and the “most important” software. EWF is enabled in delayed write mode.
D: - the second section in the system, without any accelerators - the main thing here is reliability. Personal documents are stored, toys installed, some software, as well as the image of the RAM disk is saved when it is turned off.
ram drives (FAT32)
E: - frames disk, with preservation of data in the image on the disk D, on which the transferred user profiles are located. Approximate size of 300-400MB.
F: - frames the disk without saving the data, at the root is the paging file, the folder TEMP for storing temporary files. 500-600Mb.
You can do without the letters E and F if you connect the volumes of RAM disks as "empty NTFS folders." For example, connect drive E as a folder c: \ Documents and Settings \ username \ and cancel the drive letter, and F by screwing the same to the windows / temp directory with canceling the drive letter, but at the same time SWAP will have to be thrown in the same folder, and not to the root. For SuperSpeed RamDisk Plus, this can be done through the Windows "Disk Management", for Gavotte RAMDisk you will have to work via the command line directly with the utility. This method is more preferable because you don't have to bother with “symbolic links” (folders pointing to a different directory or drive) and do not create a lot of disks in the system.
Now to the implementation.
Suppose we have a disk (SSD or simple HDD), it has two partitions, C: for system and D: for user data.
Turning off the indexing of files on all NTFS volumes (for SSD is evil), page file, system recovery, sleep mode (unfortunately, you will have to use only the standby mode).
Clean the folder c: \ WINDOWS \ Prefetch and c: \ Windows \ system32 \ dllcache \.
We execute in the command line sfc / cachesize = 0 .
Install SuperSpeed RamDisk, throw in the Program Files program Gavotte RAMDisk. To use inaccessible memory in SuperSpeed in the settings, you need to put a few checkboxes (more google), in Gavotte - register in the registry [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ RRamdisk \ Parameters] "UsePAE" = dword: 00000001 (usually there is a reg file).
We create a RAM disk SuperSpeed, set the mode of saving the image when it is turned off (the storage location is disk D). He will create a drive with a letter.
Reboot and log in as Administrator (if not visible - administrator display on startup [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ SpecialAccounts \ UserList] parameter of the dword type “Adminus” = “00000001”). Use the pens to move everything from c: \ Documents and Settings \ username \ to the newly created RAM disk (the folder - the source file should become empty) and go to My Computer - Manage - Disk Management. We find the RAM disk, delete the drive letter and create a path by specifying the user folder on drive C. Everything, you can now restart and check the stability of your work - your data is stored in memory and written to the image on drive D when reboots.
Now we create a frame disk using Gavotte RAMDisk, specify the size, delete the drive letter (backspace) and click “apply”. Next, mount the disk as a folder by executing rdutil link C: \ windows \ temp (after cleaning it beforehand). It is also necessary to rewrite the paths of the tmp and temp environment variables to this path (the temp folder is initially used inside the user profile).
Now you need to connect the SWAP file, and in the same temp folder - we execute addswap C: \ windows \ TEMP \ pagefile.sys 384 384 . You can check whether the file is picked up at startup by rebooting and trying to remove it from temp (the system should not allow), also in the root of the C drive there should be neither pagefile.sys, nor hiberfil.sys.
The last stage is to reboot in safe mode, copy the files for EWF and execute the reg file (usually it goes with it in the archive). When using the reg file, it must answer that ALL data is transferred. Next, reboot and activate the delayed write mode.
Some optimization of Windows is also desirable - here is a listing of the reg file that I run every time I install XP for everyone! user He does not claim to be super correct, so I advise you to analyze each item and decide whether you personally need it.
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management \ PrefetchParameters]
"EnablePrefetcher" = dword: 00000000
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Dfrg \ BootOptimizeFunction]
"Enable" = "N"
"OptimizeComplete" = "No"
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ OptimalLayout]
"EnableAutoLayout" = dword: 00000000
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem]
"NtfsDisable8dot3NameCreation" = dword: 00000001
"NtfsDisableLastAccessUpdate" = dword: 00000001
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management]
"DisablePagingExecutive" = dword: 00000001
"LargeSystemCache" = dword: 00000001
"IOPageLockLimit" = dword: 03e80000
[HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Control \ PriorityControl]
Win32PrioritySeparation = dword: 00000005
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager]
"BootExecute" = ""
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ PriorityControl]
"IRQ8Priority" = dword: 00000001
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ SubSystems]
"Posix" = -
"Optional" = -
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ AeDebug]
"Auto" = "0"
[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]
"NoRecentDocsHistory" = dword: 00000001
[HKEY_CURRENT_USER \ Control Panel \ Desktop]
"MenuShowDelay" = "50"
"FontSmoothing" = "2"
"FontSmoothingType" = "2"
"FontSmoothingOrientation" = "1"
[HKEY_CURRENT_USER \ software \ microsoft \ windows \ currentversion \ explorer \ advanced]
TaskbarGroupSize = dword: 00000006
"SeparateProcess" = dword: 00000001
[HKEY_CURRENT_USER \ Control Panel \ Keyboard]
"InitialKeyboardIndicators" = "2"
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ MyComputer \ NameSpace \ DelegateFolders \ {59031a47-3f72-44a7-89c5-5595fe6b30ee}]
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control]
"WaitToKillServiceTimeout" = "10,000"
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ RemoteComputer \ NameSpace \ {2227A280-3AEA-1069-A2DE-08002B30309D}]
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ RemoteComputer \ NameSpace \ {D6277990-4C6A-11CF-8D87-00AA0060F5BF}]
[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]
“NoFFavorMenu” = dword: 00000001
"NoRecentDocsMenu" = dword: 00000001
"NoSMHelp" = dword: 00000001
"MemCheckBoxInRunDlg" = dword: 00000001
"NoActiveDesktop" = dword: 00000001
"NoLowDiskSpaceChecks" = dword: 00000001
"NoSharedDocuments" = dword: 00000001
The hp-shny EWF will work with this Windows, but it turned out to get a new version from Windows 7, in which the buffer of turn-down recording is about 1300 MB. In this regard, there is no need to transfer the user's folder from Documents and Settings (besides, the latter has grown to indecent sizes) and all the manipulations are reduced to turning on the EWF, adding a RAM disk using Gavotte RAMDisk and moving the swap file there. The reg file is also more modest. I am not sure about the relevance of many parameters, I left only some of them.
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management \ PrefetchParameters]
"EnablePrefetcher" = dword: 00000000
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Dfrg \ BootOptimizeFunction]
"Enable" = "N"
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ OptimalLayout]
"EnableAutoLayout" = dword: 00000000
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem]
"NtfsDisableLastAccessUpdate" = dword: 00000001
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management]
"LargeSystemCache" = dword: 00000001
[HKEY_CURRENT_USER \ Control Panel \ Desktop]
"MenuShowDelay" = "150"
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager]
"BootExecute" = ""
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ AeDebug]
"Auto" = "0"
[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]
"NoRecentDocsHistory" = dword: 00000001
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ MyComputer \ NameSpace \ DelegateFolders \ {59031a47-3f72-44a7-89c5-5595fe6b30ee}]
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control]
"WaitToKillServiceTimeout" = "10,000"
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ RemoteComputer \ NameSpace \ {2227A280-3AEA-1069-A2DE-08002B30309D}]
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ RemoteComputer \ NameSpace \ {D6277990-4C6A-11CF-8D87-00AA0060F5BF}]
[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]
"MemCheckBoxInRunDlg" = dword: 00000001
"NoLowDiskSpaceChecks" = dword: 00000001
For ease of use EWF on my desktop are two batch file. The first flushes the buffer to the disk and turns off the EWF until the next system boot (relevant when installing the software). The second one shows in brief how much the buffer has been spent:
EWF memory reset.bat
ewfmgr c: -commitanddisable -live
ewfmgr c: -enable
pause
EWF state.bat
@ewfmgr -all | find "Volume Name"
@ewfmgr -all | find "State"
@ewfmgr -all | find "Boot Command"
@ewfmgr -all | find "Memory used for data"
pause
So the goal:
1. Protecting the SSD disk (there are a lot of opinions about their "survivability", if you put the Windows and the paging file on them);
2. Accelerating the reaction of Windows to user actions;
3. Acceleration of applications and system services;
4. Use of memory over 3GB (in case the Windows do not see it).
Methods and tools:
1. The main tool EWF (Enhanced Write Filter - advanced write filter).
It is included with Windows XP Embedded. The main functions of the module are deferred recording to disk (all changed data is saved on the HDD at the same time when you log out or at the command of the user) and “freeze system state” (any recording on the disk is prohibited, every time the PC is turned on, the system has a status at the time the function is activated) . There are many descriptions and examples of using EWF in the network (for example, you can download the program and software that controls the operating modes of EWF, I didn’t see the new version of EWF from Win7 on the network, I can put it) Pros and cons of this module:
- + Once a modified file (for example, the user registry file NTUSER.DAT) will be stored in memory and all calls will go to its copy in memory, thereby increasing the speed of the system
- + All recording to disk takes place in memory - increasing system speed.
- + you can enable deferred recording on one specific disk partition
- + You can “throw off” all changes to disk (for example, when installing heavy software)
- - all recording to disk takes place in memory - loss of power leads to data loss (or rather loss of changes during a session)
- - the size of the buffer in memory is 512 MB - when it is full, the SYSTEM hangs to the head with a loss of all changes per session (in the Windows Embedded Standard 7 version this limit is increased to ~ 1300 MB)
- - there is no installer per se (you need to copy the files with the replacement, and edit the registry, and in safe mode, because some registry branches do not have access to reg files)
2. Method - transfer TEMP files to RAM disk.
Reassign the path of the TMP and TEMP environment variables to the RAM disk (System Properties - Advanced - Environment Variables). The Windows / TEMP and Documents and Settings \ "User" \ Local Settings \ Temp \ folders should be replaced with links to the TEMP folder in the RAM disk (this can be done by simply creating a folder shortcut or creating a "symbolic link" with third-party tools, for example, described here ). I don’t presume to do it correctly. I spent little time on this issue, but everything worked fine for me. Links should be made only for "crookedly written" programs that assume the TEMP directory exclusively in the Windows folder. Pros and cons of the method:
- + no need to clean the TEMP directory on the RAM disk (data will be lost on each reboot)
- + some system acceleration
- + Some utilities allow the creation of a RAM disk in memory above 3GB, thereby it is possible to use "inaccessible" memory
- + getting rid of the SSD disk from storing temporary files
- - limited size of the TEMP folder (for some software, 500-800MB is not enough)
- - some software discards the data it needs in the TEMP directory after a reboot, naturally after it will not be there
3. Method - transfer the SWAP file to the RAM disk.
By standard means, it is possible to transfer the paging file to another disk, but I ran into a problem when, at the start of the RAM system, the disk is picked up after the SWAP file is picked up. As a result, Windows itself creates a resizable file on the disk with the system. The output I found is the addswap.exe program (as part of the Gavotte RAMDisk utility), which allows you to “pick up” the paging file after the system has started (in fact, it is recreated every time the system starts), and you can create the file not in the root, but by of the way. It is necessary to run it only once. Questionable opinions about the fact that the C drive must have a paging file, even if the minimum size (something there with memory dumps during the collapse of programs, etc.), as well as the opinion that without it the system works almost better (I still don’t trust Windows, even the seven, and try to keep a small 500-1000MB swap file in the system, it’s still in memory, but I always recommend using the “fixed” swap file size). Pros and cons of the method:
- + speeding up access to the paging file
- + creating a RAM disk in inaccessible memory above 3GB
- + getting rid of the SSD drive from storing the paging file
- + paging file fragmentation is no longer important.
- - limited paging file size
4. Tools - create a RAM disk in unused OS memory.
Suppose we have a 32bit Windows, 4GB of RAM installed, and the motherboard BIOS supports them. The OS usually sees 3 ... 3.5GB of RAM, the rest remains inaccessible (the PAE key in boot.ini did not help in my case). I know 2 programs that could create a RAM disk in inaccessible memory - SuperSpeed RamDisk Plus and Gavotte RAMDisk. The first one is quite “heavy”, it saves data from the RAM disk when shutting down, and restores them at system startup, but does not hook up the paging file (the RAM disk is mounted too late at system start). The second is simple and not whimsical, it has the ability to work through the command line, you can save data manually (or by writing bat files for autoloading), the main advantage is that I managed to install a paging file on it so that when the system started it would pick up on its own (but this happens a bit crooked - in the settings of the paging file in the OS, this SWAP file is not visible, but the total SWAP volume is indicated correctly). Both programs can create a TEMP folder when mounting a disk (conveniently if you use the “do not save data when you turn off the computer” mode). And one more noticeable minus of SuperSpeed - let's say you use “save data on shutdown”, if the disk is 100 MB full, then it’s logical that the image file of this disk will be comparable, BUT if you ever filled the disk with 300 MB, then the disk image will never be Smaller (even remove all data from the RAM disk), only the re-creation of the disk helps.
')
5. Method - do not store personal data on the disk with the system and even more so on the desktop.
All "My Documents", movies, photos, etc. I advise you to keep NOT on the system partition of the disk. You can call the reason for the slowdown, especially when it is objectively stored on the desktop, but the main reason is data integrity. Personally, I have long since switched to using the server at home - all the data in the family is stored there, it is secure and allows access to it from any computer, laptop and PDA. It is always on, always available, and when asked why keep the server just for this - I have a NAS server only a fraction of the capabilities it has implemented. In connection with the problem of inaccessibility of data "outside the home" - I believe you will come up with a solution (my solution is a VPN connection, and no more than 10 files on the laptop / pc with you). There is still a feeling of “impunity”, I remember sweating in 96g then, realizing that an important hard disk section had collapsed, now I vyzalyatsya over Windows as I want, with confidence that with the problem I will restore it from Acronis image in 10 minutes (on the same server about 10 images on different computers and laptops and with different operating systems for them). Another plus is that 16GB of hard drive is enough for me to work under Win7.
6. Method - transfer user folders to RAM disk.
Don't hit hard - I had reasons to do that. At first I turned on EWF mode on the system disk, after some time I began to miss the 512MB buffer for comfortable work (I had to reboot the computer once every 1-2 days, and usually it was in my “sleep mode” for weeks and extremely seldom). After analyzing which files change most often (otzhiraya while EWF buffer) came to the conclusion that it is to a lesser extent the files of Windows in the WINDOWS and Program Files folders and to a large extent the current user folder. It was decided to post a user folder (two users in my case) and Windows / programs files to different disks.
The minimum program is to make 2 logical disks - on the first Windows, on the second two folders of users from Documents and Settings. For each disk, enable EWF, thereby increasing the total maximum buffer to 1GB.
The maximum program is to transfer the user's folder to the saved RAM disk - we get a very decent increase in speed, but you need to save the image of this disk to a section WITHOUT EWF, and that is the risk of overflowing the buffer and getting stuck when the system reboots while saving the RAM disk image. Advantages and disadvantages:
- + a tangible increase in speed (shortcuts, part of the registry, desktop - all this is now in memory)
- + The response of the system to user actions is simply amazing !!!
- + EWF buffer is now not decreasing so quickly (you can work without rebooting 3-5 days)
- - the same risk of losing changes during a session when there is a hang / loss of power
- - size is limited (sometimes the user’s folder can be just huge)
7. Method - the correct layout SSD drive.
The problem is quite logical when a logical block of data (equal, for example, to one physical block on a disk) is located on a disk with an offset. The consequence of this is that when reading / writing one logical block of data, work happens with “two halves”, and in fact with two physical blocks on the disk. In theory, when formatting a disk under Win7, such problems should not arise, but it is advisable to check it all the same, for example, using the Paragon Alignment Tool.
So, we take a picture of the universe and stupidly see what's what ...
I will try to more clearly describe what I got and the sequence of actions to achieve this.
I started with Windows XP 32bit
The disk structure should be the following:
real partitions or disks (NTFS)
C: - preferably the first one on a fast disk, it has a Windows (minus the TEMP folder and user folders from Documents and Settings) and the “most important” software. EWF is enabled in delayed write mode.
D: - the second section in the system, without any accelerators - the main thing here is reliability. Personal documents are stored, toys installed, some software, as well as the image of the RAM disk is saved when it is turned off.
ram drives (FAT32)
E: - frames disk, with preservation of data in the image on the disk D, on which the transferred user profiles are located. Approximate size of 300-400MB.
F: - frames the disk without saving the data, at the root is the paging file, the folder TEMP for storing temporary files. 500-600Mb.
You can do without the letters E and F if you connect the volumes of RAM disks as "empty NTFS folders." For example, connect drive E as a folder c: \ Documents and Settings \ username \ and cancel the drive letter, and F by screwing the same to the windows / temp directory with canceling the drive letter, but at the same time SWAP will have to be thrown in the same folder, and not to the root. For SuperSpeed RamDisk Plus, this can be done through the Windows "Disk Management", for Gavotte RAMDisk you will have to work via the command line directly with the utility. This method is more preferable because you don't have to bother with “symbolic links” (folders pointing to a different directory or drive) and do not create a lot of disks in the system.
Now to the implementation.
Suppose we have a disk (SSD or simple HDD), it has two partitions, C: for system and D: for user data.
Turning off the indexing of files on all NTFS volumes (for SSD is evil), page file, system recovery, sleep mode (unfortunately, you will have to use only the standby mode).
Clean the folder c: \ WINDOWS \ Prefetch and c: \ Windows \ system32 \ dllcache \.
We execute in the command line sfc / cachesize = 0 .
Install SuperSpeed RamDisk, throw in the Program Files program Gavotte RAMDisk. To use inaccessible memory in SuperSpeed in the settings, you need to put a few checkboxes (more google), in Gavotte - register in the registry [HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ RRamdisk \ Parameters] "UsePAE" = dword: 00000001 (usually there is a reg file).
We create a RAM disk SuperSpeed, set the mode of saving the image when it is turned off (the storage location is disk D). He will create a drive with a letter.
Reboot and log in as Administrator (if not visible - administrator display on startup [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ SpecialAccounts \ UserList] parameter of the dword type “Adminus” = “00000001”). Use the pens to move everything from c: \ Documents and Settings \ username \ to the newly created RAM disk (the folder - the source file should become empty) and go to My Computer - Manage - Disk Management. We find the RAM disk, delete the drive letter and create a path by specifying the user folder on drive C. Everything, you can now restart and check the stability of your work - your data is stored in memory and written to the image on drive D when reboots.
Now we create a frame disk using Gavotte RAMDisk, specify the size, delete the drive letter (backspace) and click “apply”. Next, mount the disk as a folder by executing rdutil link C: \ windows \ temp (after cleaning it beforehand). It is also necessary to rewrite the paths of the tmp and temp environment variables to this path (the temp folder is initially used inside the user profile).
Now you need to connect the SWAP file, and in the same temp folder - we execute addswap C: \ windows \ TEMP \ pagefile.sys 384 384 . You can check whether the file is picked up at startup by rebooting and trying to remove it from temp (the system should not allow), also in the root of the C drive there should be neither pagefile.sys, nor hiberfil.sys.
The last stage is to reboot in safe mode, copy the files for EWF and execute the reg file (usually it goes with it in the archive). When using the reg file, it must answer that ALL data is transferred. Next, reboot and activate the delayed write mode.
Some optimization of Windows is also desirable - here is a listing of the reg file that I run every time I install XP for everyone! user He does not claim to be super correct, so I advise you to analyze each item and decide whether you personally need it.
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management \ PrefetchParameters]
"EnablePrefetcher" = dword: 00000000
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Dfrg \ BootOptimizeFunction]
"Enable" = "N"
"OptimizeComplete" = "No"
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ OptimalLayout]
"EnableAutoLayout" = dword: 00000000
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem]
"NtfsDisable8dot3NameCreation" = dword: 00000001
"NtfsDisableLastAccessUpdate" = dword: 00000001
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management]
"DisablePagingExecutive" = dword: 00000001
"LargeSystemCache" = dword: 00000001
"IOPageLockLimit" = dword: 03e80000
[HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Control \ PriorityControl]
Win32PrioritySeparation = dword: 00000005
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager]
"BootExecute" = ""
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ PriorityControl]
"IRQ8Priority" = dword: 00000001
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ SubSystems]
"Posix" = -
"Optional" = -
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ AeDebug]
"Auto" = "0"
[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]
"NoRecentDocsHistory" = dword: 00000001
[HKEY_CURRENT_USER \ Control Panel \ Desktop]
"MenuShowDelay" = "50"
"FontSmoothing" = "2"
"FontSmoothingType" = "2"
"FontSmoothingOrientation" = "1"
[HKEY_CURRENT_USER \ software \ microsoft \ windows \ currentversion \ explorer \ advanced]
TaskbarGroupSize = dword: 00000006
"SeparateProcess" = dword: 00000001
[HKEY_CURRENT_USER \ Control Panel \ Keyboard]
"InitialKeyboardIndicators" = "2"
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ MyComputer \ NameSpace \ DelegateFolders \ {59031a47-3f72-44a7-89c5-5595fe6b30ee}]
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control]
"WaitToKillServiceTimeout" = "10,000"
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ RemoteComputer \ NameSpace \ {2227A280-3AEA-1069-A2DE-08002B30309D}]
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ RemoteComputer \ NameSpace \ {D6277990-4C6A-11CF-8D87-00AA0060F5BF}]
[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]
“NoFFavorMenu” = dword: 00000001
"NoRecentDocsMenu" = dword: 00000001
"NoSMHelp" = dword: 00000001
"MemCheckBoxInRunDlg" = dword: 00000001
"NoActiveDesktop" = dword: 00000001
"NoLowDiskSpaceChecks" = dword: 00000001
"NoSharedDocuments" = dword: 00000001
Now about Windows 7 32bit
The hp-shny EWF will work with this Windows, but it turned out to get a new version from Windows 7, in which the buffer of turn-down recording is about 1300 MB. In this regard, there is no need to transfer the user's folder from Documents and Settings (besides, the latter has grown to indecent sizes) and all the manipulations are reduced to turning on the EWF, adding a RAM disk using Gavotte RAMDisk and moving the swap file there. The reg file is also more modest. I am not sure about the relevance of many parameters, I left only some of them.
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management \ PrefetchParameters]
"EnablePrefetcher" = dword: 00000000
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Dfrg \ BootOptimizeFunction]
"Enable" = "N"
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ OptimalLayout]
"EnableAutoLayout" = dword: 00000000
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem]
"NtfsDisableLastAccessUpdate" = dword: 00000001
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager \ Memory Management]
"LargeSystemCache" = dword: 00000001
[HKEY_CURRENT_USER \ Control Panel \ Desktop]
"MenuShowDelay" = "150"
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager]
"BootExecute" = ""
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ AeDebug]
"Auto" = "0"
[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]
"NoRecentDocsHistory" = dword: 00000001
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ MyComputer \ NameSpace \ DelegateFolders \ {59031a47-3f72-44a7-89c5-5595fe6b30ee}]
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control]
"WaitToKillServiceTimeout" = "10,000"
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ RemoteComputer \ NameSpace \ {2227A280-3AEA-1069-A2DE-08002B30309D}]
[-HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ RemoteComputer \ NameSpace \ {D6277990-4C6A-11CF-8D87-00AA0060F5BF}]
[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ Explorer]
"MemCheckBoxInRunDlg" = dword: 00000001
"NoLowDiskSpaceChecks" = dword: 00000001
For ease of use EWF on my desktop are two batch file. The first flushes the buffer to the disk and turns off the EWF until the next system boot (relevant when installing the software). The second one shows in brief how much the buffer has been spent:
EWF memory reset.bat
ewfmgr c: -commitanddisable -live
ewfmgr c: -enable
pause
EWF state.bat
@ewfmgr -all | find "Volume Name"
@ewfmgr -all | find "State"
@ewfmgr -all | find "Boot Command"
@ewfmgr -all | find "Memory used for data"
pause
Source: https://habr.com/ru/post/111835/
All Articles