EWF Modes (Standard 8)

7/8/2014

Review the two modes for Enhanced Write Filter (EWF) for Windows Embedded 8 Standard (Standard 8).

There are two different modes of Enhanced Write Filter (EWF) based on the implementation of the EWF volume. EWF stores the overlay data in RAM. The EWF volume can be located in unpartitioned space on the media, or in the system registry.

Select the mode of the EWF overlay when you configure the EWF settings. EWF RAM Reg mode requires additional configuration settings after you deploy the run-time image.

EWF RAM Mode

EWF RAM mode uses the following configuration:

• The EWF Overlay type is stored in RAM.
• The EWF volume is stored on disk.

The EWF RAM overlay stores the write cache in RAM. When EWF RAM mode is configured during the EWF installer phase, the EWF volume is created in available space on media. The EWF volume stores the EWF master volume table and an overlay stack that points to the overlay data in system memory. When you shut down the target system, the overlay data in system memory is lost. EWF RAM mode supports only one overlay level.

Use EWF RAM mode in the following scenarios:

• Protecting data on a read/write volume from being changed or corrupted.
• Deploying a run-time image on a stateless device.
• Deploying a run-time image on a device without persistent read/write storage.

The following diagram shows an example EWF RAM mode configuration.

EWF RAM overlays require additional RAM to store the write cache. RAM is not pre-allocated by EWF. Therefore, EWF uses free RAM until the system runs out of memory. RAM requirements for the EWF RAM overlay vary. They depend on the amount of write operations that are made to the overlay. We recommend that, although you test your run-time image, you review the memory usage of your applications in Windows Embedded 8 Standard (Standard 8) Task Manager.

For more information, see Configure EWF RAM Mode.

EWF RAM Reg Mode

EWF RAM Reg mode resembles EWF RAM mode. It differs from the standard EWF RAM mode only in that the configuration information that is stored in the EWF volume is instead stored in the system's registry. EWF RAM Reg mode uses the following configuration:

• The EWF Overlay is stored in RAM.
• The EWF volume is stored in the system's registry.

Use RAM Reg mode in the following scenarios:

• Protecting media that has only a single partition or media that cannot be partitioned.
• Protecting removable media, such as CompactFlash, USB, or IEEE 1394 devices.
• Protecting media that does not support standard RAM overlays.
• Reducing the number of write operations that are made to write-sensitive devices, such as CompactFlash.

The following illustration shows an example of how EWF RAM Reg mode is configured on your device.

Because the EWF volume information is kept in the registry, if the registry is write-protected, any attempts to disable EWF will fail. There are three ways that you can disable EWF in EWF Ram Reg mode:

• Disable EWF, and then commit the overlay to the protected volume.
  For example:

  ewfmgr c: -disable
  ewfmgr c: -commit
  

  Warning

  You must restart the system in the previous scenario because the overlay is written to the protected volume on the next system restart.

-Or-

• Use the CommitandDisable command to disable EWF and commit the overlay.
  For example:

  ewfmgr c: -commitanddisable
  

  Warning

  You must restart the system in the previous scenario because the overlay is written to the protected volume on the next system restart.

-Or-

• Use the -live option of the CommitandDisable command to disable EWF and commit the overlay to the protected volume without having to restart the system.
  For example:

  ewfmgr c: -commitanddisable -live
  

For more information, see EWF Manager.

For more information about how to configure EWF RAM Reg mode, see Configure EWF RAM Reg Mode.

You can also protect multiple volumes by using EWF RAM Reg mode. For more information, see Protect Multiple Volumes By Using RAM Reg Mode.

See Also

Concepts

Enhanced Write Filter (EWF) Overview
EWF Architecture