EWF Overview

  • Article

5/10/2007

The Enhanced Write Filter (EWF) protects a volume from write access. EWF provides the following benefits:

  • Write-protects one or more partitions on your system
  • Enables read-only media, such as CD-ROM or flash, to boot and run

EWF can be deployed on a variety of media types and configurations. The two major components for EWF are the EWF Overlay and the EWF Volume:

  • EWF Overlay: EWF protects the contents of a volume by redirecting all write operations to another storage location. This location is called an overlay. An EWF overlay can be in RAM, or on another disk partition. An overlay is conceptually similar to a transparency overlay on an overhead projector. Any change that is made to the overlay affects the picture as it is seen in the aggregate, but if the overlay is removed, the underlying picture remains unchanged. For more information, see EWF Modes.
  • EWF Volume: In addition to the EWF overlay, an EWF volume is created on the media in unpartitioned disk space. This EWF volume stores configuration information about all of the EWF-protected volumes on the device, including the number and sizes of protected volumes and overlay levels. Only one EWF volume is created on your device, regardless of how many disks are in the system. If your media does not support multiple partitions, you can save the EWF configuration information in the system's registry. For more information, see EWF Volume Configuration.
    There can be only one EWF volume on the system. However, there can be more than one protected volume, and it is possible to have some volumes that are protected by disk overlays while others are protected by RAM overlays.

There are three different modes of EWF based on the different configurations for the EWF overlay and the EWF volume.

EWF Mode EWF Overlay Location EWF Volume Location Description

Disk

On disk

Created on disk in unpartitioned space

EWF stores overlay information in a separate partition on the system. Because the overlay is stored in a nonvolatile location, the EWF overlay information can persist between reboots.

Use EWF Disk types on a system if you want to maintain the state of the system.

For more information, see EWF Disk Mode.

RAM

In RAM

Created on disk in unpartitioned space

EWF stores overlay information in RAM. When the system is rebooted, all of the information in the overlay is discarded.

Use EWF RAM types on systems if you want to discard any write information after reboot, or to delay writing the overlay to the media.

For more information, see EWF RAM Mode.

RAM Reg

In RAM

In system registry

Similar to EWF RAM types, RAM Reg overlays store overlay information in RAM. However, the configuration information about EWF is not stored in a separate EWF volume, but within the registry.

Use EWF RAM Reg types on media that does not support changing the partition structure of the media, such as CompactFlash. CompactFlash media is typically marked as removable media. Removable media cannot be partitioned. For more information, see CompactFlash Design Considerations.

For more information, see EWF RAM Reg Mode.

In This Section

  • EWF Modes
    Describes the different implementation modes of EWF.