2 HP Write Filters

The File-Based Write Filter (FBWF) and the Enhanced Write Filter (EWF) provide two distinct ways to provide a secure environment for your computer by protecting it from unauthorized writes to storage and file systems. FBWF operates at the file level, and EWF operates at the sector level. Only one write filter can be selected and active at one time.

File-Based Write Filter

The File-Based Write Filter (FBWF) provides a secure environment for your computer by protecting it from undesired read and write access to write-sensitive or read-only storage. FBWF redirects all writes targeted for protected volumes to a RAM cache called an overlay.

FBWF has only two states, enabled or disabled, and does not have an overlay volume. When FBWF is disabled, all previous changes are lost.

Using the File-Based Write Filter command line utility

Windows® Embedded includes the FBWF command line utility. This utility enables you to issue a set of commands to the FBWF driver, report the status of each protected overlay, and report the format of the overall FBWF configurations.

By including the FBWF configuration interface in your configuration and building it into your image, you enable use of the FBWF command line utility and the corresponding commands.

To use the FBWF command line utility, follow these steps:

1.Select Start > Run.

2.Type CMD in the Open field to access the system DOS prompt.

3.Click OK.

4.Type fbwfmgr c: at the prompt.

5.Press enter.

When you enter the fbwfmgr [boot command] syntax, use the following commands in the boot command variable of the command line:

●/disable

Disables the write filter on the next restart.

●/enable

Enables the write filter on the next restart.

●/displayconfig

Displays all current configuration information for the write filter including filter state, protected volumes list, cache compression state, overlay cache threshold, cache pre-allocation status, and write through paths.

●/overlaydetail

File-Based Write Filter 11