Enhanced Write Filter (EWF) provides the ability to write-protect the run-time image. In EWF Disk mode, write operations that are made to the protected volume are written to a separate partition on the disk. There are several restore points which can be set in EWF Disk mode, it’s the major feature that EWF Disk mode differs from EWF Ram mode and EWF Reg mode.
This document will show how to enable the EWF Disk mode in Windows XP Embedded and describe how to manipulate the operations of EWF Disk mode.
Step 1. Add necessary EWF components to your XPE configuration
1. Open your XPE configuration file in Target Designer.
2. Add the following four components to your XPE configuration
Background Disk Defragmentation Disable
Enhanced Write Filter
EWF Manager Console Application
EWF NTLDR
3. Change the settings of Enhanced Write Filter component
Fill up the fields with appropriate value
Set the overlay type to disk
The size of EWF partition can’t less than 32MB
Overlay levels is the number of restore points
4. Check dependencies and build the run-time image
Step 2. Configure the disk partitions
Verify that the disk on which you configure EWF has no more than three partitions. During the First Boot Agent (FBA) phase, EWF creates an EWF volume on the media; so you need some un-partitioned free space. Disks are limited to a total of four primary partitions. If you are using logical partitions, free space for EWF must be contained within the extended partition.
Step 3. Deploy the run-time image and boot the device
Operations of EWF Disk mode
EWF Disk mode supports the ability to set checkpoint up to nine points. With these checkpoints, we can restore OS to a particular overlay.
We can use this command EWFMGR <drive-letter>(optional) [options] to deal with the functions of EWF Disk mode. All these commands require rebooting to apply the changes.
Example
-all
|
Displays information about all protected volumes
> ewfmgr –all
Displays information about particular protected volumes
> ewfmgr c: |
-nocmd
|
Clears the current pending command
> ewfmgr c: -nocmd |
-enable
|
Enables the write filter
> ewfmgr c: -enable |
-disable
|
Disables the overlay on the specified protected volume
> ewfmgr c: -disable |
-commit
|
Commits all current level data in the overlay to the protected volume, and resets the current overlay level to 1
> ewfmgr c: -commit |
-checkpoint
|
Starts a new overlay level
> ewfmgr c: -checkpoint |
-restore
|
Restores to the prior overlay
> ewfmgr c: -restore |
-setlevel=current lvl + 1
|
Same as -checkpoint
> ewfmgr c: -setlevel=current lvl + 1 |
-setlevel=current lvl - 1
|
Same as -restore
> ewfmgr c: -setlevel=current lvl - 1 |
-setlevel= - lvl
|
Sets the level, discarding all data above the specified level
> ewfmgr c: -setlevel=-2 |
留言列表
English Articles (1)
