Note: This section is for informational use only and contains no additional procedural instructions.
Windows XP Embedded Enhanced Write Filter (EWF)
Windows XP Embedded uses the EWF to protect a volume from write transactions. Architecturally the EWF
is implemented as a filter driver to redirect and cache all writes destined for a protected volume into an
EWF overlay. The write cache in the EWF overlay remains available to the partition, so the EWF overlay
creates the illusion that the protected volume is writeable.
A commandline tool called EWF Manager is available to manage the EWF, and can be used to commit the
write cache in the EWF overlay to the protected target drive partition for permanent storage (see below).
EWF RAM Registry mode
EdgeTech Sonar systems use EWF RAM Registry mode. With EWF RAM Registry mode, the write cache is
stored in a RAM based overlay, and the EWF configuration information is stored in the system's registry.
The entire write cache is lost when the system is powered down. This ensures that the target always
powers up in exactly the same configuration.
EWF RAM Registry mode requires a special “warm” restart procedure to commit the EWF overlay write
cache to the protected partition for permanent storage (see below).
EWF Manager
A commandline tool called EWF Manager is available to manage the EWF, and can be used to commit the
EWF overlay to a protected target drive partition.
To maintain the integrity of the EdgeTech factory installed Windows XP Embedded operating system, users
are strongly advised against using the EWF manager. Situations where the use of the EWF Manager
cannot be avoided include the changing of network settings and installation of new hardware devices.
Due to the extremely limited target drive WINXPE partition space, it is essential that some Windows XP
Embedded cleanup is done before committing an existing EWF overlay to the target drive permanently.
Files that should be deleted before a “commit” are located in:
WINXPE ( C: )
WINDOWS \ Temp
Documents and Settings \ Administrator \ Local Settings \ History \ Today
\ Temp
\ Temporary Internet Files
\ My Recent Documents
EWF Manager Commandline Syntax
Display the Enhanced Write Filter (EWF) status
“ewfmgr c:”
Commit overlay data to protected volume on next restart
“ewfmgr c: -commit”
Warm Restart procedure
For EWF RAM Registry mode, a Warm Restart, without powering down, must follow the “commit”
command, otherwise the RAM based overlay data will be lost during the powered down state.
Warm Restart, without powering down, by clicking: Start Menu → Windows Security → Restart