60
OPEraTING SySTEMS
4.3 EWf implementation in the Windows Embedded Standard 7 images
All the KEB Windows Embedded Standard 7 images have a built-in support for En-
hanced Write Filter (EWF).
EWF protects a volume from write access.
Its two major components are the EWF Overlay and the EWF Volume:
• EWF Overlay: EWF protects the contents of a volume by redirecting all write opera-
tions to another storage location. This location is called an overlay. An EWF overlay
can be in RAM, or on another disk partition. An overlay is conceptually similar to
a transparency overlay on an overhead projector. Any change that is made to the
overlay affects the picture as it is seen in the aggregate, but if the overlay is re-
moved, the underlying picture remains unchanged.
• EWF Volume: In addition to the EWF overlay, an EWF volume is created on the me-
dia in unpartitioned disk space. This EWF volume stores configuration information
about all of the EWF-protected volumes on the device, including the number and
sizes of protected volumes and overlay levels. Only one EWF volume is created on
your device, regardless of how many disks are in the system. If your media does not
support multiple partitions, you can save the EWF configuration infor-mation in the
system‘s registry (RAM Reg Mode, KEB’s choice)
EWF was configured by KEB with the RAM Reg Mode to protect the C: volume. So, the
overlay is in RAM and the EWF volume location is in system registry.
If EWF is activated, each write operation for C: is redirected to an overlay in the RAM
memory. no data will be permananetly stored into C.
In case of a reboot or of a system restart after a power failure, the overlay will be reset
and all the data written in the previous session will be lost. The view of volume C: will be
the same after each restart.
If no persistent volume C: is available, at least one other volume (a separate D: partition,
another storage device, a network share) must be created that contains persistent data
for the application.
This second volume will not be protected from power failures, but will not contain infor-
mation that is vital for system booting.
On KEB Windows Embedded Standard 7 images, EWF is disabled by default at ship-
ment and it must be enabled by the customer, in case it is needed.
4.4 KEB Write filter Manager (KEB-Wf_MGr)
4.4.1 Introduction
KEB Write Filter Manager bases on the Enhanced Write Filter (EWF) from Microsoft for
Windows Embededd Standard 7(WES7).
