Using the Enhanced Write Filter command line control

CAUTION: Terminal Administrators should use Microsoft Windows NT file security to prevent undesired usage of these commands.

CAUTION: When using the -commitcommand, all of the temporary contents are permanently written to the flash memory.

NOTE: Because the Enhanced Write Filter commands are executed on the next boot, you must restart the computer for the command to take effect.

Windows XPe includes the Ewfmgr.exe command line tool. This tool enables you to issue a set of commands to the EWF driver, report the status of each protected volume overlay, and report the format of the overall EWF configurations.

By including the EWF Manager console component in your configuration and building it into your image, you enable use of Ewfmgr.exe and the corresponding commands.

To use the Enhanced Write Filter using the command line:

1.Select Start > Run > Open.

2.Type CMD in the Open field to access the system DOS prompt.

3.Click OK.

4.Type ewfmgr c:

5.Press enter.

When you enter the ewfmgr -[boot command] syntax, use the following commands in the boot command variable of the command line:

●-all

Displays information about all protected volumes and performs a command, such as disable, enable, and commit, on each volume, if specified.

●-commit

Commits all current level data in the overlay to the protected volume, and resets the current overlay value to 1. You can combine -commit with the -disable command to commit and then disable.

●-disable

Disables the overlay on the specified protected volume.

●-enable

Enables the Enhanced Write Filter so that data written to the protected media is cached in the overlays. The current overlay level becomes 1 as soon as EWF is started, and a new overlay is created at level 1.

●-commitanddisable

Commits data in the overlay upon shutdown and disables EWF after the system reboots.

14 Chapter 2 Enhanced Write Filter