Write Filters Overview (Standard 8)

Article
09/29/2016

7/8/2014

Review the features available in the Unified Write Filter (UWF), Enhanced Write Filter (EWF), and File-Based Write Filter (FBWF) in Windows Embedded 8 Standard (Standard 8).

You can use write filters in your embedded system to help protect your physical storage media, including any standard writable storage type that is supported by Windows 8, such as physical hard disks, solid state drives, USB flash drives, etc. You can also use write filters to make read-only media appear to the OS as a writable volume.

Windows Embedded 8 Standard (Standard 8) includes the following three different write filters:

Unified Write Filter (UWF)
Enhanced Write Filter (EWF)
File-Based Write Filter (FBWF)

UWF is a new feature in Standard 8, and combines the functionality of both EWF and FBWF. EWF and FBWF are included in Standard 8 mainly for backward compatibility.

Note

UWF is mutually exclusive with EWF, FBWF, and Registry Filter. If you include UWF in your Standard 8 image, you cannot include EWF, FBWF, or Registry Filter. Conversely, if you include EWF, FBWF, and Registry Filter in your image, you cannot include UWF in your Standard 8 image.

Write filters intercept writes to protected volumes, and redirect the writes to an overlay that records changes to protected volumes. By redirecting attempted writes to an overlay, write filters can make a write-protected volume appear to function as a writeable volume. The overlay does not mirror the entire volume, but dynamically grows to keep track of redirected writes. Generally the overlay is stored in system memory, although in Unified Write Filter (UWF) you can cache a portion of the overlay on a physical volume.

Some of the benefits to using write filters include the following:

Reduced wear on write-sensitive media such as compact USB flash devices
Increased system reliability
Support for stateless device operation

These benefits come at the cost of added complexity when managing and deploying your device. You must consider your management, update, and deployment scenarios when you consider using write filters in your devices, in addition to the requirements and restrictions of each write filter.

Write Filter Features

The following table shows the different features that each write filter includes.

Functionality	UWF	EWF	FBWF
File/folder exclusions	Yes	No	Yes
Registry key exclusions	Yes	No*	No*
Sector-based filtering	Yes	Yes	No
Supports Hibernate Once/Resume Many (HORM)	Yes	No	No
RAM-based overlay	Yes	Yes	Yes
Providers for Windows Management Instrumentation (WMI) version 2	Yes	No	No
Disk-backed overlay	Yes	No	No
Commit volume	No	Yes	No
Commit file	Yes	No	Yes

* You can use Registry Filter to make registry entries on volumes protected with EWF or FBWF persistent.

Unified Write Filter (UWF)

UWF operates at the sector level, intercepting all writes to a protected volume. However, you can specify that certain files, directories, or registry keys are excluded from being filtered. Excluded files and directories are tracked in a file exclusion list, and excluded registry entries are tracked in a registry exclusion list. Writes to items in an exclusion list are written directly to the protected volume.

Note

UWF fully supports the NTFS file system, however, during device startup, NTFS file system journal files can write to a protected volume before UWF has loaded and started protecting the volume.

You can increase the uptime of a system by configuring UWF to use a disk-backed overlay. This causes UWF to cache a portion of the overlay on the system volume, which generally enables a significantly greater maximum overlay size. If your device is write-sensitive, you can configure UWF to maintain the overlay entirely in system memory.

UWF also supports the use of paging to increase virtual memory, if the page file exists on an unprotected volume. When paging is used together with a RAM-based overlay, the uptime of the system can be significantly increased.

For more information about UWF, see Unified Write Filter (UWF) Overview.

Hibernate Once/Resume Many (HORM)

UWF includes Hibernate Once/Resume Many (HORM) functionality, which lets you use a re-use a hibernation file under certain conditions. You can use HORM to boot your device to a preconfigured state. Normally, hibernation files are discarded on restart, but on a device with HORM enabled the hibernation file is not discarded, and the device will reuse the same hibernation file on every restart until a new hibernation file is created. A device with HORM enabled can quickly be turned off or shut down, and will boot into the preconfigured state upon restart, even in the event of a sudden power loss.

Using HORM requires that the device is stateless after creating the hibernation file, so that the hibernation file does not become invalid. This means that you must write-protect all fixed volumes by using UWF, and you must specify no file or registry exclusions in UWF.

Registry Key Persistence

You can use UWF to allow registry entry changes on a UWF protected device to persist across system restarts. If you do not use UWF or Registry Filter to exclude registry entries on a write-protected system, changes to the registry only last until the system is restarted.

Enhanced Write Filter (EWF)

EWF intercepts writes to protected volumes at the sector level. Operating at the sector level means that EWF fully supports the NTFS file system.

EWF does not allow file exclusions. You can enable registry exclusions by using Registry Filter. If a volume is protected by EWF, the entire volume is considered write-protected.

For more information about EWF, see Enhanced Write Filter (EWF) Overview.

File-Based Write Filter (FBWF)

FBWF intercepts writes to protected volumes at the file level. This allows you to specify files or directories that are excluded from being filtered. Writes to excluded files and directories are written directly to the protected volume. You can enable registry exclusions by using Registry Filter.

Because FBWF intercepts writes at the file level instead of at the sector level, FBWF does not support some NTFS features, including file compression, file encryption, etc.

You can commit specific files from the overlay to the FBWF protected volume; however, you cannot commit the entire overlay to an FBWF protected volume in a single action.

For more information about FBWF, see File-Based Write Filter (FBWF) Overview.

Registry Filter

You can use Registry Filter with EWF or FBWF to make changes to registry keys and registry values persistent after restarting on a write-protected system. Registry Filter does not make the registry changes persistent until system shutdown, so changes may be lost if Windows 8 does not shutdown gracefully.

For more information about Registry Filter, see Registry Filter Overview.

Write Filter Exclusions

You can add specific files or folders on a protected volume to a file exclusion list to exclude those files and folders from being filtered. You can also add specific registry keys to an exclusion list to exclude those keys from being filtered.

For information about UWF-specific exclusions, see Unified Write Filter (UWF) Overview.

For information about write filter exclusions for specific Standard 8 features, see Common Write Filter Exclusions.