Quite often I am running into this at customers: “What shall we choose: RAM or RAMReg mode for EWF?”
Of course my answer always starts with “ It depends…”, but in this case it is often quite clear: RAMReg should be the preferred option!
Well, the only difference between both modes is the configuration table, which in RAM mode is stored in an additional, small partition on the disk. The additional partition is of a special type, which is not always recognized by disk cloning tools. The EWF configuration partition not seldom leads to cloning errors and strange EWF behavior, if not handled correctly.
In contrast RAMReg stores the partition table in registry. Benefits are that you do not have to handle an additional partition, therefore cloning is easier and much less error prone.
However, having settings stored in registry means that is this partition is protected you need to commit and disable the filter, if you want to change its settings. The registry, in this case, is protected by EWF as well.