Write Protect your Run-Time Image with EWF (Windows Embedded Standard 2009)


You can prevent accidental writes, attacks, or other harmful access to your run-time image by implementing the Enhanced Write Filter. Enhanced Write Filter intercepts all writes made to a run-time image and stores them in an alternate storage area. This storage area is called an overlay, and can be a separate partition on a disk, or in RAM.

For more information, see Enhanced Write Filter.

Enhanced Write Filter should not be used as an anti-virus solution. Worms and viruses can spread quickly throughout a network, and even if a run-time image is protected with EWF, a virus can still infect it. Because the virus is stored in the EWF overlay, the virus will continue to propagate to other systems. Even if the overlay is discarded when the system reboots, other systems on the network can continue to infect your run-time image. If an EWF overlay is committed to the protected volume, the system will become infected.

Community Additions