EWF NTLDR

  • Article

The EWF NTLDR component provides a modified version of NT Loader that is written for the EWF overlay mapping structures and that can access the most recent snapshot of the disk. The modified NT Loader uses all cached disk-write operations that are stored in the overlay volume while the operating system is loaded. This strategy makes it possible to boot from the protected volume and ensures that any updates to boot drivers or registry keys persist after rebooting.

The EWF NTLDR component is required to boot from writable media that is protected by EWF. It is not required to boot from read-only media that uses a RAM overlay.

For more information about EWF, see Enhanced Write Filter.

Services

There are no services associated with this component.

Associated Components

This component is associated with the Enhanced Write Filter component, and with the NT Loader component.

Settings

There are no configurable settings for this component.

Last updated on Wednesday, October 18, 2006

© 2006 Microsoft Corporation. All rights reserved.