Moxa DA-681A-I-DPP-LX [15/42] Enhanced write filter

DA-681A Series Windows Software Enabling Embedded Filters

4-2

Enhanced Write Filter

Overview

Enhanced Write Filter (EWF) provides a means for protecting a volume from unauthorized writes by making the

main OS drive a write-protected volume, effectively making the system a read-only system for most users. This

gives much stronger protection against malicious computer code like trojans, worms, and viruses.

Enhanced Write Filter (EWF) allows Windows 7 users to protect all of the data on their storage drive from

permanent changes of any sort, at the lowest level of hardware protection available: the bit level. EWF allows

the operating system (OS) to boot from the hard disk, but protects the system by creating a virtual file system

called an overlay. All writes to an EWF-protected volume (the hard disk, in Fig. 1) are only recorded on this

virtual overlay (the EWF Volume, in Fig. 1), which is stored independently in random access memory (RAM).

Because EWF does not write data directly to the hard disk but instead only records system writes to this virtual

RAM overlay, any data that is “written” during system operation will disappear upon the next re-boot. This

approach allows the system to operate as if it is writeable when in reality all OS and user-space file systems are

stored in a permanent, read-only state. If desired, the data written to the overlay can be committed to the

protected volume, but this requires additional setup and permissions that can only be granted by the

administrator. Refer to the following figure (from Microsoft) for an overview of the EWF structure.

For more detailed information about EWF configuration and usage, refer to any of the following resources:

• Visit Microsoft’s EWF Volume Configuration

help pages.

• See Microsoft’s EWF overview on the official Microsoft EWF help pages.

• See Microsoft’s detailed description of EWF modes on the EWF help pages.

• See Microsoft’s detailed description of the EWF API.

• For EWF commands, refer to the MSDN web site:

http://msdn.microsoft.com/en-us/library/ms940853%28v=winembedded.5%29.aspx