Using Compact Flash (CF) with the Enhanced Write Filter (EWF)

  • Article

 

Stephen Berard and John Macintyre
Microsoft Corporation

June 2003

Applies to:
    Microsoft® Windows® XP Embedded with Service Pack 1

Summary: This document details how to build an image that boots to CompactFlash with the Enhanced Write Filter.

Contents

Introduction
Building the Image
Deploying
Enabling EWF
Troubleshooting
Conclusion
Additional Resources

Introduction

One of the benefits of using Microsoft® Windows® XP Embedded is the ability to create devices that boot to Compact Flash™ (CF). There are many advantages to using CF, most notably creating solid-state devices. These devices are usually more reliable as they have no moving parts. The downside of using CF is that it has a limit to the number of times one can write to a storage location. Over time, the CF media will fail. The Enhanced Write Filter (EWF) provides a way of protecting the underlying volume from writes. This avoids wearing out the media but imposes the restriction of running protected volumes as stateless. This article will describe a means for building a Windows XP Embedded image and deploying it to CF with EWF enabled.

Note that this article assumes your CF cannot be partitioned. There are utilities available from many CF vendors that will mark the media as non-removable and enable you to partition it. Where possible, it is usually better to partition the CF when using EWF. Partitioned configurations provide better support for disabling and storing persistent data.

In this configuration, the EWF settings are stored in the registry. Although it avoids the problem of partitioning the flash media, it does impose a few restrictions on your configuration. One restriction on this type of configuration is that there can only be one protected volume. There is no way to have EWF protect multiple volumes. If you need to protect multiple volumes, you will need to partition your flash media and use a standard configuration as described in the Windows XP Embedded documentation. Another restriction is that the "disable" command cannot be used. This is because the EWF settings are stored only in the registry, which is write-protected by EWF. Instead, you need to use the "commit and disable" command.

Building the Image

Start by building your image as you normally would, using Target Designer. Normally, when using EWF, the disk must be partitioned so there is unused disk space available for the EWF configuration partition. Most CF media cannot be partitioned due to the fact that it appears as removable media. Therefore, EWF must be configured manually through the registry. To accomplish this, build the image and then enable EWF after the First Boot Agent (FBA) completes.

To your configuration, add the following components:

  1. Enhanced Write Filter
  2. EWF NTLDR
  3. EWF Manager Console application
  4. Registry Editor (optional)
  5. Enhanced Write Filter API (optional)

In addition, you must make sure that you set EWF to be disabled by default and to not create the EWF partition. To do this, clear the Start EWF Enabled check box under the configuration settings of the Enhanced Write Filter component (see Figure 1).

ms838638.cf_ewf2(en-US,WinEmbedded.5).gif

Figure 1. Disabling EWF

Then disable the FBA DLL/COM Registration step of the component. This is under the Resources settings (see Figure 2).

ms838638.cf_ewf1(en-US,WinEmbedded.5).gif

Figure 2. Disabling FBA DLL/COM Registration

If these steps are not executed, EWF will attempt to create the EWF partition (and fail). If EWF is started as enabled, the following modifications will not "stick," because EWF will prevent the data from being written to the underlying volume.

Deploying

Next, deploy the image to your target hardware. Boot the device and allow FBA to complete.

Note   If you are formatting your device using File Allocation Table (FAT), you will need to run bootprep.exe to make the partition bootable. Any manual modifications to your image should be done at this point, because you will be enabling EWF in the next step.

Enabling EWF

The next step is to enable EWF on the boot volume. Because the FBA step was disabled in the EWF component, EWF was not configured by Target Designer and FBA. This must be done manually via the registry.

First, verify that the following entries are present on your device:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf]
"ErrorControl"=dword:00000001
"Group"="System Bus Extender"
"Start"=dword:00000000
"Type"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
"UpperFilters"="Ewf"

Then, add the following entries to your device:

 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ewf\Parameters\Protected\Volume0]
"VolumeID"="{1EA414D1-6760-4625-8CBE-4F9F85A48E15}"
"Type"=dword:00000001
"ArcName"="multi(0)disk(0)rdisk(0)partition(1)"

These changes can be made by importing a REG file using RegEdit (if included), or you can edit the registry offline using RegEdit (as it ships with your computer) on another computer. The final entry, "ArcName", should reflect the ArcName for the partition you wish to protect.

Finally, reboot your system. EWF is now enabled and will protect the CF volume from writes.

Troubleshooting

The EWF Manager Application is a console utility used to manage EWF on the device. It allows you to control EWF operation. You can check the EWF status by issuing the following command:

Ewfmgr C:  (where C: is your protected volume)

EWF manager displays a result similar to the following:

Protected Volume Configuration
  Type            RAM
  State           ENABLED
  Volume ID       BB E6 0E BC 00 64 15 00 05 00 00 00 00 00 00 00 
  Device Name     "\Device\HarddiskVolume1" [C:]
  Max Levels      1
  Clump Size      512
  Current Level   1

  Memory used for data 2624000 bytes
  Memory used for mapping 4096 bytes

If you attempt to run EWF manager by itself or on a unprotected partition, you will receive an error. The message will indicate that it was unable to locate the EWF volume. All nonstatus commands take effect on the next reboot. For more information, see the Windows XP Embedded documentation. It is important to note that by using the registry to configure EWF, the filter can only be disabled by performing a CommitandDisable operation.

Conclusion

The Enhanced Write Filter is often used to protect flash media from writes. This helps to extend the life of the media. Unfortunately, the standard configuration for EWF cannot be used on all flash media. The registry setup described previously provides a means to using EWF in those situations where the standard configuration will not work or is not optimal.

For additional information, see the product documentation or the Embedded Community Web site.

Additional Resources

For more information about Windows XP Embedded, see Windows XP Embedded home page.

For online documentation and context-sensitive Help included with Windows XP Embedded, see Windows XP Embedded product documentation.

© Microsoft Corporation. All rights reserved.