Moxa DA-685-W7E [9/38] Enhanced write filter

DA-685 / W7E Enabling Windows 7 Write Protections

3-2

Enhanced Write Filter

Overview

Enhanced Write Filter (EWF) provides a means for protecting a volume from unauthorized writes by making the

main OS drive a write-protected volume, effectively making the system a read-only system for most users. This

gives much stronger protection against malicious computer code like trojans, worms, and viruses.

Enhanced Write Filter (EWF) allows Windows 7 users to protect their all information on their storage drive

from permanent changes of any sort, at the lowest level of hardware protection available: the bit level. EWF

allows the operating system (OS) to boot from the hard disk, but protects the system by creating a virtual file

system called an overlay. All writes to an EWF-protected volume (the hard disk, in Fig. 1) are only recorded

on this virtual overlay (the EWF Volume, in Fig. 1), which is stored independently in random access memory

(RAM). Because EWF does not write data directly to the hard disk but instead only records system writes to this

virtual RAM overlay, any data that is “written” during system operation will disappear upon the next re-boot.

This approach allows the system to operate as if it is writeable when in reality all OS and user-space file

systems are stored in a permanent, read-only state. If desired, the data written to the overlay may be

committed to the protected volume, but this requires additional setup and permissions that can only be granted

by the administrator. Refer to the following figure (from Microsoft) for an overview of the EWF structure.

To get more details about EWF configuration and usage, you may:

• Visit Microsoft’s EWF Volume Configuration help pages.

• Visit Microsoft’s EWF overview on the official Microsoft EWF help pages.

• Visit Microsoft’s detailed description of EWF modes on the EWF help pages.

• Visit Microsoft’s detailed description of the EWF API.

For the EWF commands, refer to the MSDN web site:

http://msdn.microsoft.com/en-us/library/ms940853%28v=winembedded.5%29.aspx