EWF Disk Mode

EWF Disk mode uses the following configuration:

• EWF Overlay is stored in unpartitioned space on the disk
• EWF volume is stored at the beginning of the EWF Overlay on the disk

In EWF Disk mode, write operations that are made to the protected volume are written to a separate partition on the disk. The beginning part of this partition includes the EWF volume. The EWF volume stores the EWF master volume table and the overlay stack. Each overlay stack corresponds to a protected volume and is partitioned into multiple levels that correspond to a checkpoint.

Use EWF Disk mode in the following scenarios:

• Protecting data on a read/write volume from being altered or corrupted
• Providing multiple snapshots of disk contents
• Allowing committing disk write operations to the protected volume image
• Reverting to a particular overlay level

The following diagram shows an example of how EWF Disk mode is configured on your device.

When you shut down the system, the EWF overlay data is retained because the overlay information is stored on a local disk.

In EWF Disk mode, EWF allows you to layer more than one overlay on top of a protected volume. Therefore, you can remove overlay layers from the top of the overlay stack to restore the view of the volume back to a prior version.

The following illustration shows the multiple overlay concept.

EWF Disk mode requires unpartitioned space on the boot drive. The EWF volume and overlay, collectively referred to as the EWF partition, cannot be created on a different physical drive or on a raw, unpartitioned disk. It is possible, however, to protect one or more partitions on a different drive from the boot drive, regardless of whether a partition on the boot drive is being protected. During the FBA phase, the EWF partition is created on the disk. The minimum size for the EWF partition is 32 MB. This means that the maximum size of the volume is 32 MB, and the EWF overlay size is set in Target Designer when you configure the EWF component.

EWF Disk mode supports multiple levels of overlay, and each overlay level contains separate data. When applied to the protected volume, the overlay levels provide an aggregate view of the protected volume and all write operations that are made to that volume. There is a configurable limit to the maximum overlay level. After this limit is reached, EWF does not create higher overlay levels and the checkpoint command fails.

For more information, see Configuring EWF Disk Mode.

Note   If you use a pagefile with an EWF disk overlay, you should relocate the pagefile to an unprotected volume. For more information, see Changing the Location of the Pagefile.

See Also

EWF Definitions | EWF Modes | EWF RAM Mode | Enhanced Write Filter API

Last updated on Wednesday, October 18, 2006

© 2006 Microsoft Corporation. All rights reserved.