to call the EWF Manager. A user can also change the EWF configuration by entering EWF management commands at the command prompt. This task requires the administrator privilege.

•Enable disk write protection and restart your computer

If the EWF is disabled, enable it. If this item is selected, the cache is flushed and the EWF is enabled. After restarting your computer, the configurations and file system information for the client are written to a cache. You can also perform this operation by entering “ewfmgr.exe c: -enable” at the command prompt and restarting your computer.

•Disable disk write protection and restart your computer

This item is activated when the EWF is running. If this item is selected, the current states of the client (saved in a cache) are saved to a flash volume and the EWF is disabled. After restarting your computer, the configurations and file system information for the client are written to a flash volume. You can also perform this operation by entering “ewfmgr.exe c: - commitanddisable” at the command prompt and restarting your computer.

•Write the changes to a disk

This item is activated when the EWF is running. If this item is selected, the current states of the client (saved in a cache) are saved to a flash volume. However, the state of EWF will not be changed. You can also perform this operation by entering “ewfmgr.exe c: -commit” at the command prompt.

You can view the configurations for the protected volumes by entering “ewfmgr.exe c:” at the command prompt.

File-Based Write Filter (FBWF)

The File-Based Write Filter (FBWF) protects the memory of the client from being overwritten by any unauthorized user. By restricting excessive writing into the memory, the FBWF allows you to use the client for a long time. If you request I/O, the FBWF has the client perform its operations using the cache instead of the memory so that the memory can be protected.

The data saved in the cache is preserved while the client operates normally. It is removed when it is restarted or exited. To save the changes, you should write the relevant file onto the disk using the commit command. If you don’t know which file is changed, disable the FBWF, change it, and enable it again.

Installing the Software

4-1