2
HP Write Filters
The File-Based Write Filter (FBWF) and the Enhanced Write Filter (EWF) provide two distinct ways to
provide a secure environment for your computer by protecting it from unauthorized writes to storage
and file systems. FBWF operates at the file level, and EWF operates at the sector level. Only one
write filter can be selected and active at one time.
File-Based Write Filter
The File-Based Write Filter (FBWF) provides a secure environment for your computer by protecting it
from undesired read and write access to write-sensitive or read-only storage. FBWF redirects all
writes targeted for protected volumes to a RAM cache called an overlay.
FBWF has only two states, enabled or disabled, and does not have an overlay volume. When FBWF
is disabled, all previous changes are lost.
Using the File-Based Write Filter command line utility
Windows® Embedded includes the FBWF command line utility. This utility enables you to issue a set
of commands to the FBWF driver, report the status of each protected overlay, and report the format of
the overall FBWF configurations.
By including the FBWF configuration interface in your configuration and building it into your image,
you enable use of the FBWF command line utility and the corresponding commands.
To use the FBWF command line utility, follow these steps:
1.
Select
Start
>
Run
.
2.
Type
CMD
in the Open field to access the system DOS prompt.
3.
Click
OK
.
4.
Type
fbwfmgr c:
at the prompt.
5.
Press
enter
.
When you enter the
fbwfmgr [boot command]
syntax, use the following commands in the boot
command variable of the command line:
●
/disable
Disables the write filter on the next restart.
●
/enable
Enables the write filter on the next restart.
●
/displayconfig
Displays all current configuration information for the write filter including filter state, protected
volumes list, cache compression state, overlay cache threshold, cache pre-allocation status, and
write through paths.
●
/overlaydetail
File-Based Write Filter
11
