Moxa DA-682A-C7-DPP-LX [11/36] Da 682a dpp windows software enabling windows 7 write protections

DA-682A-DPP Windows Software Enabling Windows 7 Write Protections

3-2

Enhanced Write Filter

Overview

The Enhanced Write Filter (EWF) allows Windows 7 users to protect the information on their storage drive from

permanent changes of any sort. The write protection is implemented at the bit level, which is at the lowest level

of the hardware and is therefore more secure. EWF allows the operating system (OS) to boot from the hard disk,

but protects the system by creating a virtual file system called an overlay. All writes to a EWF-protected volume

(the Hard disk in the figure below) are only recorded on this virtual overlay (the EWF Volume in the figure

below), which is stored independently in random access memory (RAM). Because EWF does not write data

directly to the hard disk but instead only records system writes to this virtual RAM overlay, any data that is

“written” during system operation will not be stored upon the next re-boot. This approach allows the system to

operate as if it is writeable when in reality the data is written to a virtual overlay. The OS and user-space file

systems are stored in a permanent read-only state. You can commit the data from the overlay to the protected

volume, but this requires additional effort. The structure of the enhanced write filter is illustrated in the

following figure (source Microsoft):

Additional details on EWF configuration and usage are available on the Microsoft website at:

• EWF overview

• EWF Volume Configuration

• EWF modes

• EWF API

For EWF commands, refer to the MSDN web site:

http://msdn.microsoft.com/en-us/library/ms940853%28v=winembedded.5%29.aspx