I have read about unified write filter. The main working is that overlay is created which write the data on it instead of writing it on volume. Now i am facing a scenario that my overlay size is suppose 1024K and i write 1G data on the protected volume which is more than the overlay size. It gives errors in event log and all the things it should do. On reboot, it vanishes all the written data despite of low size and error messages.
I am wondering about overlay, what is it exactly? (i know its virtual memory).
Does it increase with increasing write data?
What is overlay size? Why is it used and whats its usage other than throwing threshold or exceed errors in event log?
Thanks in advance.