Prefetch and EWF Performance

Before I get started, let me lay down a warning – If you reached this article because you’re searching for information on Prefetch *and* your using any version of Windows other than the embedded version (if you’re using embedded Windows, you know it; if you don’t know for sure, you’re not), stop reading right now.

A short time back I wrote an article on disabling the NTFS feature "Last Access Time Attribute." I included an MSDN link for readers to learn more about what they could do to improve the performance of the Enhanced Write Filter (EWF).

It has been pointed out that one of the referenced articles, Disabling Prefetch, appears to contradict what the experts say about the Prefetch feature. Not to quibble with the experts, but, um, they don’t know what they’re talking about <grin>. Well, at least not when it comes to EWF. I will admit, however, that the MSDN article on disabling Prefetch is a bit short on providing an explanation.

If you search MSDN, WHDC and TechNet for information on Prefetch, you can find several articles that provide a very good description of this Windows XP feature. And, yes, it does enhance performance unless you interfere with its operation. For example, if you delete the files created and placed in the "Prefetch directory" located in the windows root directory, Prefetch would recreate these files…providing that Prefetch is enabled…which would cause the performance to degrade. And since Prefetch *improves* performance, why would you ever disable it?

Examining the MSDN Disable Prefetch article, the wary read might notice the equivocations "can be improved" and "can degrade…performance" and wonder how. Well, first of all, this article makes the assumption that the volume EWF is protecting is the boot volume; the same volume where Prefetch would attempt to "persist" (i.e. write) its data files. If EWF is using a RAM overlay, any information written to the volume would, unless explicitly committed, be lost at the next reboot.

So, with Prefetch enabled, EWF using a RAM overlay and protecting the boot volume, you would, on each reboot, be doing exactly what the experts say you shouldn’t do – deleting the contents of the Prefetch directory. Furthermore, you would be using up a chunk of your RAM overlay to store data that would never be used. Prefetch would be spending precious clock cycles and using limited overlay storage only to have all of its work evaporate at the next reboot.

Are there conditions where Prefetch wouldn’t degrade EWF performance? Other than the obvious "if EWF isn’t protecting the boot volume", it depends on your specific application. You might consider setting Prefetch to only monitor application launches if your product has frequent application launches between reboots. Under such conditions the effort Prefetch puts into optimizing the application launch could show some payback.

In conclusion I could say that you *might* be able to improve EWF performance by either disabling or enabling Prefetch, but that would be equivocating. So, at times like this I like to use the "ultimate answer", 42 <grin>.

- Jim

Comments

• Anonymous
  August 29, 2006
  Jim, I'm the "expert" you linked to. A long, long time ago, someone in the comments of one of those threads mentioned the MSDN article, and I pointed out that it was referring to Windows Embedded. For what it's worth, everything I write is about desktop (and occasionally server) versions of Windows. I hope no one would apply the information in my article to a Windows Embedded installation!
• Anonymous
  September 13, 2006
  The comment has been removed