Now that FBWF has been out for awhile there has been some feedback that has come through as to what directories and/or files should be added to the Write-Through list. As apart of a "good practices" article I'm going to try to keep this article up to date with new ideas/additions that I see added over time.

This first list are entries that I've personally come up with.

• \Windows\System32\Config\*.EVT - The Windows Event Logs are stored here along side of the registry hives. To allow the event logs to persist *WITHOUT* adding the registry hives to the write-through list then the following files can be added directly.
  • Files:
    • AppEvent.Evt
    • SecEvent.Evt
    • SysEvent.Evt
    • ACEEvent.evt
  • Reason: These are your event logs.
  • Risk(s): Adding these three files directly instead of adding the entire \Config\ folder will help you persist your event logs without allowing all registry changes to the disk - which is an inherent risk to your system.
  • Note: 'ACEEvent.evt' above was created on my system by the installation of the ATI driver package known as Catalyst. More information can be found here.
• \Windows\setupapi.log
  • Reason: The SetupAPI.LOG holds all device install and uninstall information within. If something fails to install - that information will also be there. If this file is persisted across reboots then you can figure out why device X (let's assume a USB Flash Drive) didn't work three days ago. (or something along those lines)
  • Risk(s): None that I can think of.
  • For more information please visit the MSDN Windows Hardware Developer Central site named "Troubleshooting Device Installation with the SetupAPI Log File" here.

All credit for the list in this section goes to Desi Richards who posted this content in this MSDN XPe Forums thread.

• \Documents and Settings\<username>\
  • Reason: Allows user(s) to persist user-profile settings. Specific groups of user data can be allowed by specifying individual folders below this one, for example "My Documents", "Local Settings", "Application Data", etc.
  • Risk(s): Sudden power loss during write may corrupt file system. System will not boot until chkdsk.exe is run against the volume (Correct?).
• \WINDOWS\System32\config\
  • Reason: Allows registry information to persist across reboots. Individual registry hives can be persisted by specifying the hive data file in this folder.
  • Risk(s): Sudden power loss during write may corrupt file system. System will not boot until chkdsk.exe is run against the volume.
• The files in the MSMQ\Storage folder include message files (xxxxxxxxx.mq files), a history file (QMLog file), and state files for received message (MQInSeqs.lgx files) and transaction operations (MQTrans.lgx files). The files in the \lqs\ folder are text files that describe the properties of the local public and private queues. They are formatted as .ini files.
  • Reference: Storage Folder Files
  • Risk(s): Sudden power loss during write may corrupt file system. MSMQ will not boot until chkdsk.exe is run against the volume.

When I hear of new/interesting "islands of inprotection" (as I affectionately call Write-Throughs) I'll be sure to update this post.

- Nick