EWF Overview (Standard 7 SP1)


The Enhanced Write Filter (EWF) protects a volume from write access. EWF provides the following benefits:

  • Write-protects one or more partitions on a system
  • Enables booting from read-only media, such as flash

EWF can be deployed on many media types and configurations.

EWF cannot protect media that is marked as "Removable". EWF can only protect media that is marked as "Fixed".

The two major components for EWF are the EWF Overlay and the EWF Volume:

  • EWF Overlay: EWF protects the contents of a volume by redirecting all write operations to another storage location called an overlay. An EWF overlay is located in RAM. An overlay is conceptually similar to a transparency overlay on an overhead projector. Any change that is made to the overlay affects the picture as it is seen in the aggregate. However, if the overlay is removed, the underlying picture remains unchanged.
  • EWF Volume: There are two different EWF modes based on the configuration of the EWF volume.

    EWF Mode

    EWF Overlay Location

    EWF Volume Location



    In RAM

    Created on disk in unpartitioned space

    EWF stores overlay information in RAM. When the system is restarted, all the information in the overlay is discarded.

    Use EWF RAM types on systems if you want to discard any write information after restart, or to delay writing the overlay to the media.

    For more information, see EWF RAM Mode.

    RAM Reg

    In RAM

    In system registry

    Similar to EWF RAM types, RAM Reg overlays store overlay information in RAM. However, the configuration information about EWF is not stored in a separate EWF volume, but within the registry.

    Use EWF RAM Reg types on media that does not support changing the partition structure of the media, such as CompactFlash. CompactFlash media is typically marked as removable media. Removable media cannot be partitioned.

    For more information, see EWF RAM Reg Mode.

EWF System Requirements

Describes the system configurations required by EWF.

EWF Components

Describes the EWF support packages.

EWF Architecture

Describes the EWF driver architecture.

EWF Volume Configuration

Describes the processing and configuration of the EWF volume.

EWF Configuration in Image Configuration Editor

Describes how to use Image Configuration Editor to configure EWF.

EWF Modes

Describes the different implementation modes of EWF.

EWF Design Considerations

Describes the design considerations before you deploy EWF.

Troubleshooting EWF

Describes common problems and troubleshooting options for EWF.