EWF Architecture

Enhanced Write Filter (EWF) is an upper filter driver in the volume stack. It is located between file systems and the class drivers that interface with physical disks.

The following illustration shows the EWF architecture.

EWF Manager (EWFMGR) is a console application that provides a command-line interface for managing EWF. The EWF API is an exposed set of interfaces to the EWF driver that allows you to control EWF programmatically.

The Enhanced Write Filter driver, ewf.sys, redirects disk write I/O Request Packets (IRPs) to the EWF overlay. The EWF overlay is a write cache that can be stored in RAM or on disk. Read-only IRPs cause the EWF driver to search for a match in the current overlay stack. If the disk sector is found in the overlay, data from the overlay is returned. Otherwise, data from the protected volume is returned.

The EWF volume stores metadata about the current EWF configuration. For disk overlays, it also stores information about the protected volume.

For more information about EWF types and overlay configurations, see EWF Modes.

For more information about the EWF volume, see EWF Volume Configuration.

See Also

Enhanced Write Filter | EWF Definitions | Enhanced Write Filter API

Last updated on Wednesday, October 18, 2006

© 2006 Microsoft Corporation. All rights reserved.