EwfMgrRestore (Standard 7 SP1)

  • Article

7/8/2014

This function restores one overlay level on the specified Enhanced Write Filter (EWF)-protected volume, discarding all changes in the current level.

Syntax

BOOL EwfMgrRestore(
  HANDLE hDevice
);

Parameters

  • hDevice
    [in] Handle to the EWF-protected volume.

Return Value

If the function succeeds, the return value is TRUE. If the function fails, the return value is FALSE. Call GetLastError for extended error information.

Remarks

The overlay is restored on the next restart and is supported for disk overlays only. The API ignores this function when it is called on RAM-based overlays.

If the current level is greater than 1, the data that is contained in the current level is discarded and the current level is decremented by 1.

If the current level is 1, all data that is contained in the current level is discarded and the current level is set to 1 with a new overlay.

Example

The DoEwfRestore function in EWF API Code Sample (Sample.cpp) shows you how to use the EwfMgrRestore function.

Requirements

OS Versions: Standard 7

Header: Ewfapi.h

Link Library: Ewfapi.lib

See Also

Reference

EwfMgrCheckpoint
EwfMgrSetLevel

Concepts

EWF API Functions