CrystalDiskMark test results

RAM Disk 26.4
Test: CrystalDiskMark 9.0.3
FileSystem: exFAT
Allocation unit size: 64K
Other settings are default

Results:
rnd4k q32t1
read 1587MB/s write 220MB/s
rnd4k q1t1
read 1928MB/s write 225MB/s

Are these RAM Disk speeds normal?

Those results point to issues with your security software, not the RAM disk.

Your writes are stuck at ~220 MB/s and don't improve at all from Q1 to Q32, while reads run at ~1900 MB/s. On a RAM disk these should be symmetric: on our test machine with the identical setup (exFAT, 64K clusters, defaults), RND4K writes run at ~2000 MB/s.

Converting to time-per-operation makes it clearer:

• Your reads: ~2 µs per 4K I/O - normal.
• Your writes: ~17 µs per 4K I/O - about 15 µs of extra overhead on every write.

That 15 µs is far too large to be the actual memory copy (a 4K copy is well under a microsecond on any CPU). And a write ceiling that stays flat regardless of queue depth is the classic signature of a filter driver inspecting every single write - almost always caused by a real-time antivirus or endpoint protection.

Two things to try:

1. Exclude the RAM disk from your security software and re-run the tests. Add the RAM disk drive letter as an exclusion (or briefly turn off real-time protection), then re-run the RND4K write test. The writes should jump into the GB/s range.
   In Defender: Windows Security → Virus & threat protection → Manage settings → Exclusions.
   In other software: check its manual on how to add an exclusion.
2. See what's on the I/O path. In an administrator Command Prompt or PowerShell:
   

   fltmc filters

   - lists the filter drivers loaded and their altitude (load order).
   

   fltmc instances

   - shows which filters are actually attached to each volume - run this and look for the RAM disk's drive letter to see what's on its write path.

If you copy both outputs here, we will be able to tell you which component is intercepting the writes. Typically it is antivirus/EDR (e.g. WdFilter is Defender), but it can also be backup/sync agents or encryption filters.

If the exclusion fixes it, it was your security software scanning each write, and the RAM disk is working as intended.

Thank you

Will excluding the entire drive from real-time antivirus protection leave the computer vulnerable? And, if the drive remains under protection, will there be any improvement in write performance?

It depends on how you use the RAM disk.

If the RAM disk is only being used as temporary storage, a cache, build workspace, or scratch area, excluding it from real-time antivirus scanning is usually low risk. Your operating system, applications and permanent storage remain protected, and any files that are later copied to a protected drive will still be scanned there.

However, if you regularly download files, open email attachments, or run executables directly from the RAM disk, then excluding it reduces the protection provided by your security software and may not be appropriate.

As for performance, there is generally no way to keep full real-time scanning enabled and also achieve maximum RAM disk write performance. Real-time antivirus works by inspecting file operations, which adds overhead to every write (and sometimes reads as well). The amount varies between products, but some reduction in performance is unavoidable while scanning remains active.

I use this drive to download online files.