Was this page helpful?
Your feedback about this content is important. Let us know what you think.
Additional feedback?
1500 characters remaining
EWF Optimization Settings (XPe)
Collapse the table of content
Expand the table of content

EWF Optimization Settings (XPe)


Microsoft Corporation

November 2009

This article contains information about how to use the optimization features of the Enhanced Write Filter (EWF) to reduce overlay space usage and to protect the underlying storage device from writes.

This article describes the optimization features that are available in the EWF. You can take advantage of these optimization settings to significantly reduce overlay space usage and the number of writes to the underlying storage device.

Optimization settings are available as part of the settings for the EWF component, as shown in the following figure.


  • Overlay space usage
    In all EWF modes, (RAM, RAM REG, and DISK) overlay space consumption is directly proportional to the number of unique writes performed by applications and the operating system. For example, repeated writes to the same sector do not increase the overlay space usage.
  • RAM and RAM REG modes
    In these modes, EWF overlay is located in the physical memory, which means that writes are faster than writes to the disk. By using less overlay space you leave more physical memory for other applications. For example, if you gave up RAM mode or RAM REG mode because of physical memory shortage, you can now reconsider your scenario using one of these modes if you choose the Use Less Overlay Space option.
  • DISK mode
    In this mode, overlay is located in the EWF partition on disk. Most devices have good storage capacity that a single user session does not exceed; however, you can select the Use Less Overlay Space option in this mode if necessary. For example, this optimization is useful on storage media that has a limited lifetime, such as Compact Flash (CF) or USB flash drives (UFD). You must weigh the overlay improvement against the longer write times that result from the extra reads that this optimization uses. For more information, see EWF Optimization Internals.
  • Tracking overlay space usage by using EWFMGR (all modes)
    To determine whether these optimization settings are useful for your scenario you can measure overlay consumption with and without optimization enabled.
    After you add the EWF component to your image and then deploy the image to your device, you can use the EWFMGR console application to control EWF. EWFMGR displays the overlay consumption caused by each protected volume. In the following figure, there are 32768 bytes of stored modified data and 4096 bytes of stored mapping information, which maps physical sectors to the overlay location.
  • Tracking overlay space usage by using EWF API (only for Disk mode)
    For information, see the MSDN documentation for the EwfMgrGetProtectedVolumeConfig API.

Write requests from applications and the operating system translate to sector-level writes when they reach the EWF driver. If you do not enable optimization, EWF allocates space in the overlay for each of these sectors and writes to them. If you configure EWF to use less overlay space, it first reads the sectors into a temporary buffer and then compares them against the incoming writes. Then it allocates space in the overlay for the sectors which will be modified after the write, skipping the other sectors. The time saved depends on how many sectors are already in the overlay and how many sectors will be changed.

Overlay optimization comes at a cost: on storage devices with slower reads, large writes can experience a delay because of the read-ahead necessary when you enable optimization. You can test this benefit versus the cost by testing your user environment with and without optimization enabled.

What you have learned

This article has provided you with information about how to use EWF optimization settings to reduce overlay space usage and reduce writes to the underlying storage device.

© 2015 Microsoft