47
OPEraTING SySTEMS
• An overlay is conceptually similar to a transparency overlay on an overhead pro-
jector. Any change that is made to the overlay affects the picture as it is seen in the
aggregate, but if the overlay is removed, the underlying picture remains unchanged.
• EWF volume: In addition to the EWF overlay, an EWF volume is created on the me-
dia in unpartitioned disk space. This EWF volume stores configuration information
about all of the EWF-protected volumes on the device, including the number and
sizes of protected volumes and overlay levels. Only one EWF volume is created on
your device, regardless of how many disks are in the system. If your media does not
support multiple partitions, you can save the EWF configuration information in the
system‘s registry (RAM Reg Mode, KEB’s choice)
EWF was configured by KEB with the RAM Reg Mode to protect the C: volume. So, the
overlay is in RAM and the EWF volume location is in system registry.
If EWF is activated, each write operation for C: is redirected to an overlay in the RAM
memory. no data will be permananetly stored into C.
In case of a reboot or of a system restart after a power failure, the overlay will be reset
and all the data written in the previous session will be lost. The view of volume C: will be
the same after each restart.
If no persistent volume C: is available, at least one other volume (a separate D: partition,
another storage device, a network share) must be created that contains persistent data
for the application.
This second volume will not be protected from power failures, but will not contain infor-
mation that is vital for system booting.
On KEB Windows Embedded Standard 7 images, EWF is disabled by default at ship-
ment and it must be enabled by the customer, in case it is needed.
4.4 KEB Write filter Manager (KEB-Wf_MGr)
4.4.1 Introduction
KEB Write Filter Manager bases on the Enhanced Write Filter (EWF) from Microsoft for
Windows Embededd Standard 7(WES7).
4.4.2 How EWf works
EWF protects a volume from write access. This is realized by an EWF overlay: EWF
protects the contents of a volume by redirecting all write operations to another storage
location. This location is called an overlay. An EWF overlay can be in RAM, or on anoth-
er disk partition. An overlay is conceptually similar to a transparency overlay on an over-
head projector. Any change that is made to the overlay affects the picture as it is seen in
the aggregate, but if the overlay is removed, the underlying picture remains unchanged.
When EWF is enabled for a volume, every write operation to that volume will be redirect-
ed to an overlay in RAM and no data will be persistently stored into the volume. In case
of a reboot or of a system restart after a power failure, the overlay will be reset and all
the data written in the previous session will be lost. The view of the volume will be the
same, after every reboot. Thus the content of the volume is protected by any damage
which can be caused by power fails otherwise.
