EWF Overview
The Enhanced Write Filter (EWF) protects a volume from write access. EWF provides the following benefits:
- Write-protects one or more partitions on your system
- Enables read-only media, such as CD-ROM or flash, to boot and run
EWF can be deployed on a variety of media types and configurations. The two major components for EWF are the EWF Overlay and the EWF Volume:
EWF Overlay: EWF protects the contents of a volume by redirecting all write operations to another storage location. This location is called an overlay. An EWF overlay can be in RAM, or on another disk partition. An overlay is conceptually similar to a transparency overlay on an overhead projector. Any change that is made to the overlay affects the picture as it is seen in the aggregate, but if the overlay is removed, the underlying picture remains unchanged. For more information, see EWF Modes.
EWF Volume: In addition to the EWF overlay, an EWF volume is created on the media in unpartitioned disk space. This EWF volume stores configuration information about all of the EWF-protected volumes on the device, including the number and sizes of protected volumes and overlay levels. Only one EWF volume is created on your device, regardless of how many disks are in the system. If your media does not support multiple partitions, you can save the EWF configuration information in the system's registry. For more information, see EWF Volume Configuration.
There can be only one EWF volume on the system. However, there can be more than one protected volume, and it is possible to have some volumes that are protected by disk overlays while others are protected by RAM overlays.
There are three different modes of EWF based on the different configurations for the EWF overlay and the EWF volume.
| EWF Mode | EWF Overlay Location | EWF Volume Location | Description |
|---|---|---|---|
| Disk | On disk | Created on disk in unpartitioned space | EWF stores overlay information in a separate partition on the system. Because the overlay is stored in a nonvolatile location, the EWF overlay information can persist between reboots.
Use EWF Disk types on a system if you want to maintain the state of the system. For more information, see EWF Disk Mode. |
| RAM | In RAM | Created on disk in unpartitioned space | EWF stores overlay information in RAM. When the system is rebooted, all of the information in the overlay is discarded.
Use EWF RAM types on systems if you want to discard any write information after reboot, or to delay writing the overlay to the media. For more information, see EWF RAM Mode. |
| RAM Reg | In RAM | In system registry | Similar to EWF RAM types, RAM Reg overlays store overlay information in RAM. However, the configuration information about EWF is not stored in a separate EWF volume, but within the registry.
Use EWF RAM Reg types on media that does not support changing the partition structure of the media, such as CompactFlash. CompactFlash media is typically marked as removable media. Removable media cannot be partitioned. For more information, see CompactFlash Design Considerations. For more information, see EWF RAM Reg Mode. |
In This Section
- EWF System Requirements
Describes the system configurations required by EWF. - EWF Components
Describes the EWF support components. - EWF Definitions
Describes the terminology used when describing EWF. - EWF Architecture
Describes the EWF driver architecture. - EWF Volume Configuration
Describes the processing and configuration of the EWF volume. - EWF Configuration in Target Designer
Describes how to use Target Manager to configure EWF.
Related Sections
- EWF Modes
Describes the different implementation modes of EWF. - EWF Design Considerations
Describes the considerations to make before deploying EWF. - Troubleshooting Enhanced Write Filter
Describes common problems and troubleshooting options for EWF.
Last updated on Wednesday, October 18, 2006
© 2006 Microsoft Corporation. All rights reserved.