Share via


EWF Components (Standard 7 SP1)

7/8/2014

The Enhanced Write Filter (EWF) feature uses the following components to protect a run-time image.

  • Enhanced Write Filter with HORM Package
    The Enhanced Write Filter with HORM package contains files and settings that are required to run the Enhanced Write Filter. The Enhanced Write Filter with HORM package includes the following components and files:

    • Ewf.sys
      The filter driver that intercepts read and write requests to the protected volume and returns the appropriate data, whether from the overlay stack, or from the protected volume. For more information, see EWF Architecture.

    • Ewfcfg.exe
      This is the generic command executable for the Enhanced Write Filter with HORM component and is run during component install or servicing. The executable functions as a proxy to Ewfcfg.dll which handles all setup related issues.

    • Ewfcfg.dll
      EWF settings specified in Image Configuration Editor are stored in an answer file. This configuration DLL consumes the answer file during setup, servicing, or Sysprep and applies any customizations required of the component. Additionally, the DLL is used to facilitate various non-settings related component configuration such as hardware discovery and system component layout.

    • EWF Manager Console Application
      Ewfmgr.exe is used to issue a set of commands to the Enhanced Write Filter (EWF) driver, to report the status of each protected volume, and to report the format of the overall EWF configuration.
      For information about the command syntax of EWF manager, EWF Manager.

    • Enhanced Write Filter API (Ewfapi.dll)
      The EWF API is the library needed during runtime to support custom applications that interact with EWF.

    • Horm.dat
      The configuration file that tracks the HORM state and the EWF state with respect to the BCD volume.

      Warning

      The horm.dat file should not be modified or moved around by the end user. It is solely intended to be modified by the EWF driver.

  • Enhanced Write Filter Boot Environment Package
    The Enhanced Write Filter with HORM Package depends on the Enhanced Write Filter Boot Environment package. The Enhanced Write Filter Boot Environment is a modified, HORM-aware version of the Windows 7 Boot environment that interprets the EWF overlay mapping structures and can access the most recent snapshot of the disk. The modified Boot Environment also uses all cached disk write operations that are stored in the volume as part of loading the operating system. This makes it possible to boot from the protected volume. In addition, any updates to boot drivers or registry keys persist after reboots.

    Warning

    The Enhanced Write Filter with HORM package depends on the Enhanced Writer Filter Boot Environment which conflicts with the Windows Boot Environment. You may run into this conflict under certain circumstances. For example, if you create a basic runtime image with eCore and choose to resolve dependencies, you are prompted to select either Windows Boot Environment or Write Filter Boot Environment as a required dependency. You select Windows Boot Environment and deploy the image. Later, you create a configuration set with Enhanced Write Filter with HORM and you add the Enhanced Write Filter Boot Environment because it is a required dependency. When you attempt to perform an online update of your image using Deployment Image Servicing and Management Command-Line Options and your configuration set, the installation will fail because of the conflict between the Enhanced Writer Filter Boot Environment and the Windows Boot Environment.

See Also

Concepts

EWF API

Other Resources

Enhanced Write Filter with HORM