Export (0) Print
Expand All
1 out of 3 rated this helpful - Rate this topic

EWF Architecture

Enhanced Write Filter (EWF) is an upper filter driver in the volume stack. It is located between file systems and the class drivers that interface with physical disks.

The following illustration shows the EWF architecture.

ms912909.ewf_architecture(en-US,WinEmbedded.5).gif

EWF Manager (EWFMGR) is a console application that provides a command-line interface for managing EWF. The EWF API is an exposed set of interfaces to the EWF driver that allows you to control EWF programmatically.

The Enhanced Write Filter driver, ewf.sys, redirects disk write I/O Request Packets (IRPs) to the EWF overlay. The EWF overlay is a write cache that can be stored in RAM or on disk. Read-only IRPs cause the EWF driver to search for a match in the current overlay stack. If the disk sector is found in the overlay, data from the overlay is returned. Otherwise, data from the protected volume is returned.

The EWF volume stores metadata about the current EWF configuration. For disk overlays, it also stores information about the protected volume.

For more information about EWF types and overlay configurations, see EWF Modes.

For more information about the EWF volume, see EWF Volume Configuration.

See Also

Enhanced Write Filter | EWF Definitions | Enhanced Write Filter API


© 2006 Microsoft Corporation. All rights reserved.


Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft. All rights reserved.