EWF Overview (Standard 7 SP1)
The Enhanced Write Filter (EWF) protects a volume from write access. EWF provides the following benefits:
Write-protects one or more partitions on a system
Enables booting from read-only media, such as flash
EWF can be deployed on many media types and configurations.
|EWF cannot protect media that is marked as "Removable". EWF can only protect media that is marked as "Fixed".|
The two major components for EWF are the EWF Overlay and the EWF Volume:
EWF Overlay: EWF protects the contents of a volume by redirecting all write operations to another storage location called an overlay. An EWF overlay is located in RAM. An overlay is conceptually similar to a transparency overlay on an overhead projector. Any change that is made to the overlay affects the picture as it is seen in the aggregate. However, if the overlay is removed, the underlying picture remains unchanged.
EWF Volume: There are two different EWF modes based on the configuration of the EWF volume.
EWF Overlay Location
EWF Volume Location
Created on disk in unpartitioned space
EWF stores overlay information in RAM. When the system is restarted, all the information in the overlay is discarded.
Use EWF RAM types on systems if you want to discard any write information after restart, or to delay writing the overlay to the media.
For more information, see EWF RAM Mode.
In system registry
Similar to EWF RAM types, RAM Reg overlays store overlay information in RAM. However, the configuration information about EWF is not stored in a separate EWF volume, but within the registry.
Use EWF RAM Reg types on media that does not support changing the partition structure of the media, such as CompactFlash. CompactFlash media is typically marked as removable media. Removable media cannot be partitioned.
For more information, see EWF RAM Reg Mode.
- EWF System Requirements
Describes the system configurations required by EWF.
- EWF Components
Describes the EWF support packages.
- EWF Architecture
Describes the EWF driver architecture.
- EWF Volume Configuration
Describes the processing and configuration of the EWF volume.
- EWF Configuration in Image Configuration Editor
Describes how to use Image Configuration Editor to configure EWF.