EWF Concepts (Standard 8)
7/8/2014
Review the concepts for Enhanced Write Filter (EWF) for Windows Embedded 8 Standard (Standard 8).
Enhanced Write Filter (EWF) protects a volume from write access. EWF provides the following benefits:
- Write-protects one or more volumes on a system.
- Enables booting from read-only media, such as flash memory.
EWF can be deployed on many media types and configurations.
Important
EWF cannot protect media that is marked as "Removable". EWF can only protect media that is marked as "Fixed".
Note
The functionality of File-Based Write Filter (FBWF) in Windows Embedded 8 Standard (Standard 8) is the same as in Windows Embedded Standard 7 and is mainly included for backward compatibility.
The two major components for EWF are the EWF overlay and the EWF volume:
- EWF overlay: EWF protects the contents of a volume by redirecting all write operations to another storage location called an overlay. An EWF overlay is located in RAM. An overlay is conceptually similar to a transparency overlay on an overhead projector. Any change that is made to the overlay affects the picture as it is seen in the aggregate. However, if the overlay is removed, the underlying picture remains unchanged.
- EWF volume: There are two different EWF modes based on the configuration of the EWF volume. EWF RAM mode uses unpartitioned space on disk for the EWF volume, which stores the EWF master volume table and an overlay stack that points to the overlay data in system memory. RAM Reg mode uses the system registry to store the EWF volume.
For more information, see EWF Modes.
In This Section
- EWF Architecture
Describes the EWF driver architecture.
- EWF Volume Configuration
Describes the processing and configuration of the EWF volume in greater detail.
- EWF Design and Test Considerations
Describes features and scenarios that might help you resolve unwanted and unknown feature behavior.