The EWF interface includes the following buttons:
●Enable/Disable EWFEnables the Enhanced Write Filter so that data written to the protected media is cached in the overlays. Disables the overlay on the specified protected volume.
●Overlay ConfigurationDisplays the overlay information and is a combination of the information supplied when executing ewfmgr.exe c:
Clears the boot command from the DOS prompt.
●Commit Data to VolumeCommits all
Using the Enhanced Write Filter status utility
The EWF status utility creates an icon in the notification area of the taskbar that shows the status of the filter. You can
The EWF Status icon displays the following states:
●Red lock: EWF is disabled.
●Green lock: EWF is enabled.
●Yellow lock: EWF state will change on next boot.
If you are logged on as an administrator, you can change the status of EWF by
NOTE: Because the ewfmgr.exe utility and the EWF status service execute separate code, status changes by ewfmgr.exe are not automatically reflected by the EWF status icon.
If you use the command line to modify the EWF,
Enhanced Write Filter | 7 |