EWF and File-Based Write Filtering (Standard 7 SP1)


Standard 7 provides two write filters: File-Based Write Filtering (FBWF), which operates at the file level, and Enhanced Write Filter (EWF), which operates at the sector level. In most cases, FBWF is the better choice. However, only EWF fully supports NTFS.

The following NTFS features are supported in EWF, but not in FBWF:

  • File locking and unlocking
  • File ID in NTFS
  • Reparse points
  • Quota
  • Hard links
  • Opportunistic lock
  • File compression and encryption

In addition, only EWF may be used with Hibernate Once/Resume Many (HORM). HORM is not available when FBWF is used.

FBWF does not provide the following EWF function:

  • Live commit and disable

To use EWF and FWBF together in the same OS image, enable EWF on one volume and FBWF on another volume.