EWF Overview (Standard 7 SP1)

  • Article

7/8/2014

The Enhanced Write Filter (EWF) protects a volume from write access. EWF provides the following benefits:

  • Write-protects one or more partitions on a system
  • Enables booting from read-only media, such as flash

EWF can be deployed on many media types and configurations.

Important

EWF cannot protect media that is marked as "Removable". EWF can only protect media that is marked as "Fixed".

The two major components for EWF are the EWF Overlay and the EWF Volume:

  • EWF Overlay: EWF protects the contents of a volume by redirecting all write operations to another storage location called an overlay. An EWF overlay is located in RAM. An overlay is conceptually similar to a transparency overlay on an overhead projector. Any change that is made to the overlay affects the picture as it is seen in the aggregate. However, if the overlay is removed, the underlying picture remains unchanged.

  • EWF Volume: There are two different EWF modes based on the configuration of the EWF volume.

    EWF Mode

    EWF Overlay Location

    EWF Volume Location

    Description

    RAM

    In RAM

    Created on disk in unpartitioned space

    EWF stores overlay information in RAM. When the system is restarted, all the information in the overlay is discarded.

    Use EWF RAM types on systems if you want to discard any write information after restart, or to delay writing the overlay to the media.

    For more information, see EWF RAM Mode.

    RAM Reg

    In RAM

    In system registry

    Similar to EWF RAM types, RAM Reg overlays store overlay information in RAM. However, the configuration information about EWF is not stored in a separate EWF volume, but within the registry.

    Use EWF RAM Reg types on media that does not support changing the partition structure of the media, such as CompactFlash. CompactFlash media is typically marked as removable media. Removable media cannot be partitioned.

    For more information, see EWF RAM Reg Mode.

In This Section

  • EWF Modes
    Describes the different implementation modes of EWF.