Windows Embedded

1. System Restore
Disable the following components in OS configuration file, “System Restore Core”, “System Restore User Interface”.

2. Auto-defragment
You can turn off auto-defragment function by adding “Background Disk Defragmentation Disable” component to OS configuration file or adding following registry key on your run-time image:

Key: HKLM\Software\Microsoft\Dfrg\BootOptimizeFunction
Name: Enable
Type: REG_SZ
Value: N

3. Last Access Time Stamps
Updating timestamps can significantly decrease performance on the system, so we need to disable Last Access Time Stamps. Add following registry Key on your run-time image:

Key: HKLM\SYSTEM\CurrentControlSet\Control\FileSystem
Name: NtfsDisableLastAccessUpdate
Type: REG_DWORD
Value: 1

4. Prefetch
EWF performance can be improved by disabling Prefetch. Prefetch is a utility that loads commonly used applications to RAM when the system starts. This can degrade EWF performance. To disable prefetch, modify the following registry Key on your run-time image:

Key:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters
Name: EnablePrefetcher
Type: REG_DWORD
Value: 0

0 = Disabled
1 = Application launch prefetching enabled
2 = Boot prefetching enabled
3 = Applaunch & Boot enabled

5. Pagefile
Change the location of pagefile by editing the following registry key:

Key:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\
Name: PagingFiles
Type: REG_MULT_SZ
Data: C:\pagefile.sys 150 500

Change the path and file name of the pagefile, along with the minimum and maximum file size values (in megabytes).

6. Internet temporary files folders
Redirect temporary files folders to an unprotected volume by modifying the following registry keys on your run-time image:

Key:
HKCU\Software\Microsoft\Windows\Current Version\Explorer\User Shell Folders
Name: Cache
Type: REG_EXPAND_SZ
Value: <path_to_a_folder_on_an_unprotected_volume>

Key:
HKCU\Software\Microsoft\Windows\Current Version\Explorer\Shell Folders
Name: Cache
Type: REG_EXPAND_SZ
Value: <path_to_a_folder_on_an_unprotected_volume>

7. History folders
Redirect temporary files folders to an unprotected volume by modifying the following registry key on your run-time image:

Key:
HKCU\Software\Microsoft\Windows\Current Version\Explorer\User Shell Folders
Name: History
Type: REG_EXPAND_SZ
Value: <path_to_a_folder_on_an_unprotected_volume>

Key:
HKCU\Software\Microsoft\Windows\Current Version\Explorer\Shell Folders
Name: History
Type: REG_EXPAND_SZ
Value: <path_to_a_folder_on_an_unprotected_volume>

8. Cookies folders
Redirect temporary files folders to an unprotected volume by modifying the following registry key on your run-time image:

Key:
HKCU\Software\Microsoft\Windows\Current Version\Explorer\User Shell Folders
Name: Cookies
Type: REG_EXPAND_SZ
Value: <path_to_a_folder_on_an_unprotected_volume>

Key:
HKCU\Software\Microsoft\Windows\Current Version\Explorer\Shell Folders
Name: Cookies
Type: REG_EXPAND_SZ
Value: <path_to_a_folder_on_an_unprotected_volume>

9. TMP and TEMP folders
Redirect temporary files folders to an unprotected volume by modifying the following registry keys on your run-time image:

Key: HKCU\Environment
Name: TEMP
Type: REG_SZ
Value: <path_to_a_folder_on_an_unprotected_volume>

Key: HKCU\Environment
Name: TMP
Type: REG_SZ
Value: <path_to_a_folder_on_an_unprotected_volume>

10. Event log files
To change the location of an event log to an unprotected volume, you must modify the following three registry keys:

Key:
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\
Name: File
Type: REG_EXPAND_SZ
Value: <volume name and path>\AppEvent.evt

Key:
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Security\
Name: File
Type: REG_EXPAND_SZ
Value: <volume name and path>\SecEvent.evt

Key:
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System\
Name: File
Type: REG_EXPAND_SZ
Value: <volume name and path>\SysEvent.evt