Using the Enhanced Write Filter command line control
CAUTION: Terminal Administrators should use Microsoft Windows NT file security to prevent undesired usage of these commands.
CAUTION: When using the
NOTE: Because the Enhanced Write Filter commands are executed on the next boot, you must restart the computer for the command to take effect.
Windows XPe includes the Ewfmgr.exe command line tool. This tool enables you to issue a set of commands to the EWF driver, report the status of each protected volume overlay, and report the format of the overall EWF configurations.
By including the EWF Manager console component in your configuration and building it into your image, you enable use of Ewfmgr.exe and the corresponding commands.
To use the Enhanced Write Filter using the command line:
1.Select Start > Run > Open.
2.Type CMD in the Open field to access the system DOS prompt.
3.Click OK.
4.Type ewfmgr c:
5.Press enter.
When you enter the ewfmgr
●-all
Displays information about all protected volumes and performs a command, such as disable, enable, and commit, on each volume, if specified.
●-commit
Commits all current level data in the overlay to the protected volume, and resets the current overlay value to 1. You can combine
●
Disables the overlay on the specified protected volume.
●-enable
Enables the Enhanced Write Filter so that data written to the protected media is cached in the overlays. The current overlay level becomes 1 as soon as EWF is started, and a new overlay is created at level 1.
●-commitanddisable
Commits data in the overlay upon shutdown and disables EWF after the system reboots.
14 Chapter 2 Enhanced Write Filter