EWF and CHKDSK

Some EWF-based embedded systems occasionally run into a problem where CHKDSK insists on running each time the system reboots.  This can cause issues with breaking the system's branding (if the developer has taken steps to hide the Windows splash screens, etc), and of course it slows down the boot process.  It can also interfere with EWF, causing extra bloat in the overlay if a lot of writes occur as a result of CHKDSK's actions.  The biggest nuisance, however, is that you can't easily make it go away without disabling EWF.

What causes this?  CHKDSK usually runs at boot time when it detects that the file system on a volume hasn't been closed properly during shutdown.  This is most often the case when the system isn't properly shut down, and EWF wasn't already protecting the volume - for instance, if the machine loses power during FBA.  This can also occur if there is more than one partition on the hard drive(s) in the system and not all of them are protected by EWF - the file systems on those partitions may also be left in a "dirty" state under abnormal circumstances.

CHKDSK can also be triggered by other conditions, mainly by a registry key being set during an active session.  This usually won't stick if EWF is enabled, but suppose you commit the overlay and leave it enabled.  On the next boot, CHKDSK will run, but EWF will prevent the run flag from being removed from the protected media, and CHKDSK will run again on the following boot, and so on.  In this case, committing or disabling the overlay again should fix the problem.

- Matt