Enhanced Write Filter

The Enhanced Write Filter (EWF) provides a secure environment for your computer by protecting it from undesired flash memory writes (the operating system and functional software components reside in flash memory). The write filter also extends the life of the computer by preventing excessive flash write activity. Instead of allowing writes directly to the flash memory, it intercepts all flash writes and caches them.

In order to save changes to system configuration settings, you must disable the write filter cache or perform the -commitcommand during the current boot session. Otherwise, the new settings will be lost when the computer is shut down or restarted. If you do not want to make permanent changes, you can enable the write filter.

The write filter cache contents are not lost when you log off and on again (as the same or different user). You can disable the write filter cache after the new logon and still retain the changes.

After you disable the write filter, all future writes during the current boot session are written to the flash with no further caching until the computer is restarted. You can also enable/disable the write filter using the command line.

NOTE: Always enable the write filter after you have made all of your permanent changes.

NOTE: Only an account with administrator privileges can enable, disable, or commit the enhanced write filter.

Using the Enhanced Write Filter command line control

CAUTION: Terminal Administrators should use Microsoft Windows NT file security to prevent undesired usage of these commands.

CAUTION: When using the -commitcommand, all of the temporary contents are permanently written to the flash memory.

NOTE: Because the Enhanced Write Filter commands are executed on the next boot, you must restart the computer for the command to take effect.

Windows Embedded includes the EWF command line control. This control enables you to issue a set of commands to the EWF driver, report the status of each protected volume overlay, and report the format of the overall EWF configurations.

By including the EWF configuration interface in your configuration and building it into your image, you enable use of the EWF command line control and the corresponding commands.

To use the EWF using the command line:

1.Select Start > Run.

2.Type CMD in the Open field to access the system DOS prompt.

3.Click OK.

4.Type ewfmgr c:.

5.Press enter.

14 Chapter 2 HP Write Filters