Microsoft Windows XP Embedded

The Enhanced Write Filter (EWF) protects a volume from write access. EWF provides the following benefits:

·                 Write-protects one or more partitions on your system

·                 Enables read-only media, such as CD-ROM or flash, to boot and run

EWF can be deployed on a variety of media types and configurations. The two major components for EWF are the EWF Overlay and the EWF Volume:

·                 EWF Overlay : EWF protects the contents of a volume by redirecting all write operations to another storage location. This location is called an overlay. An EWF overlay can be in RAM, or on another disk partition. An overlay is conceptually similar to a transparency overlay on an overhead projector. Any change that is made to the overlay affects the picture as it is seen in the aggregate, but if the overlay is removed, the underlying picture remains unchanged. For more information, see EWF Modes.

·                 EWF Volume : In addition to the EWF overlay, an EWF volume is created on the media in unpartitioned disk space. This EWF volume stores configuration information about all of the EWF-protected volumes on the device, including the number and sizes of protected volumes and overlay levels. Only one EWF volume is created on your device, regardless of how many disks are in the system. If your media does not support multiple partitions, you can save the EWF configuration information in the system's registry. For more information, see EWF Volume Configuration.

There can be only one EWF volume on the system. However, there can be more than one protected volume, and it is possible to have some volumes that are protected by disk overlays while others are protected by RAM overlays.

There are three different modes of EWF based on the different configurations for the EWF overlay and the EWF volume.

EWF Mode	EWF Overlay Location	EWF Volume Location	Description
Disk	On disk	Created on disk in unpartitioned space	EWF stores overlay information in a separate partition on the system. Because the overlay is stored in a nonvolatile location, the EWF overlay information can persist between reboots. Use EWF Disk types on a system if you want to maintain the state of the system. For more information, see EWF Disk Mode.
RAM	In RAM	Created on disk in unpartitioned space	EWF stores overlay information in RAM. When the system is rebooted, all of the information in the overlay is discarded. Use EWF RAM types on systems if you want to discard any write information after reboot, or to delay writing the overlay to the media. For more information, see EWF RAM Mode.
RAM Reg	In RAM	In system registry	Similar to EWF RAM types, RAM Reg overlays store overlay information in RAM. However, the configuration information about EWF is not stored in a separate EWF volume, but within the registry. Use EWF RAM Reg types on media that does not support changing the partition structure of the media, such as CompactFlash. CompactFlash media is typically marked as removable media. Removable media cannot be partitioned. For more information, see CompactFlash Design Considerations. For more information, see EWF RAM Reg Mode.

EWF RAM Reg mode is similar to EWF RAM mode. It differs from the standard EWF RAM mode only in that the configuration information that is stored in the EWF volume is instead stored in the system's registry. EWF RAM Reg mode uses the following configuration:

·                 EWF Overlay is stored in RAM

·                 EWF volume is stored in the system's registry

The EWF RAM Reg overlay stores the write cache in RAM. When EWF RAM Reg mode is configured, EWF configuration is skipped during the First Boot Agent (FBA) process.

After FBA is complete, you must manually edit the system registry to enable EWF. No EWF volume is created on the system. EWF RAM mode supports only one overlay level.

Use RAM Reg mode in the following scenarios:

·                 Protecting media that has only a single partition, or media that cannot be partitioned

·                 Protecting removable media, such as CompactFlash, USB, or IEEE 1394 devices

·                 Protecting media that does not support standard RAM overlays

·                 Minimizing the number of write operations that are made to write-sensitive devices, such as CompactFlash

The following diagram shows an example of how EWF RAM Reg mode is configured on your device.

Because the EWF volume information is kept in the registry, if the registry is write-protected, attempts to disable EWF will fail. You must use the EWF Manager commitanddisable command to commit the changes to the registry and disable EWF. For more information, see EWF Manager Commands.

If you are protecting more than one partition, you only need to commit the overlay to the partition where the Registry is stored. For example, if you had two protected partitions, C: and D:, you would use the EWF Manager command to disable the overlay on D:, and then commit the changes to the registry on C:.

				
						
								ewfmgr d: -disable
						
				
		

				
						
								ewfmgr c: -commit
						
				
		

For more information about configuring EWF RAM Reg mode, see Configuring EWF RAM Reg Mode.

You can also protect multiple volumes by using EWF RAM Reg modes. For more information, see Protecting Multiple Volumes By Using RAM Reg Mode.

 

EWF RAM mode uses the following configuration:

·                 The EWF Overlay type is stored in RAM

·                 The EWF volume is stored on disk

The EWF RAM overlay stores the write cache in RAM. When EWF RAM mode is configured during the First Boot Agent (FBA) phase, the EWF volume is created in available space on media. The EWF volume stores the EWF master volume table and an overlay stack that points to the overlay data in system memory. When you shut down the target system, the overlay data in system memory is lost. EWF RAM mode supports only one overlay level.

Use EWF RAM mode in the following scenarios:

·                 Protecting data on a read/write volume from being altered or corrupted

·                 Deploying a run-time image on a stateless device

·                 Deploying a run-time image on a device without persistent read/write storage

The following diagram shows an example EWF RAM mode configuration.

EWF RAM overlays require additional RAM to store the write cache. RAM is not pre-allocated by EWF; therefore EWF uses free RAM until the system runs out of memory. RAM requirements for the EWF RAM overlay vary. They depend on the amount of write operations that are made to the overlay. It is recommended that while you test your run-time image, you review the memory usage of your applications in Windows Task Manager.

Note    EWF allocates space for the RAM overlay from physical RAM pages, and can surpass the standard Windows non-paged limit of 256 MB. However EWF does allocate a small amount of space from the non-paged memory pool. Non-paged RAM size is typically less than 1.5% of the size of the RAM overlay, and the non-paged RAM usage is less than .2% of the total usage.

For more information, see Configuring EWF RAM Mode.

EWF RAM Reg mode is a type of RAM overlay that does not require an EWF volume to be present on the system. The metadata information that is normally kept in the EWF volume is instead stored in the registry. For more information, see EWF RAM Reg Mode.

The minimum EWF volume size for EWF RAM mode is 64 KB.

 

 

 

 

Microsoft Windows XP Embedded

By adding the Enhanced Write Filter (EWF) component to your configuration, you can reduce the wear on your CompactFlash device. Before you create your configuration for a CompactFlash device, be aware of the following considerations:

·                 The instructions provided in How to Configure EWF for CompactFlash show how to implement EWF RAM Reg Mode. In EWF RAM Reg mode, the EWF volume configuration information is stored in the registry, which is protected by EWF.

To disable EWF, you must use the EWFMGR commitanddisable command. Because the EWF configuration information is protected by EWF, committing the overlay writes all changes to the protected volume, including the EWF disable command.

Before you create your CompactFlash run-time image, familiarize yourself with EWF RAM Reg Mode.

·                 Typically, CompactFlash devices are marked as removable and cannot be partitioned by using Windows XP partitioning tools. Some manufacturers include utilities to mark their CompactFlash devices as non-removable (fixed) to allow additional partitioning. Use your manufacturer's CompactFlash partitioning tools to edit the partition sizes of your CompactFlash device.

·                 The instructions provided in How to Configure EWF for CompactFlash require a CompactFlash to IDE adapter. USB CompactFlash card readers are not supported.

·                 You should disable pagefile support on your run-time image, or, if possible, relocate your pagefile to a non-protected volume. Using a pagefile can add a significant amount of overhead in the RAM overlay. For more information, see Changing the Location of the Pagefile.