Moxa V2403-C7-W-T [17/63] Enhanced write filter

V2403 Series Windows Software Enabling Embedded Filters

4-2

Enhanced Write Filter

Overview

Enhanced Write Filter (EWF) enables you to protect a volume from unauthorized writes by making the main

operating system (OS) drive a write-protected volume, effectively making the system a read-only system for

most users. This provides much stronger protection against malicious computer attacks (such as trojans,

worms, and viruses).

Enhanced Write Filter (EWF) allows Windows 7 users to protect data on their storage drive from permanent

changes of any sort, at the lowest level of hardware protection available: the bit level. EWF allows the OS to

boot from the hard disk, but protects the system by creating a virtual file system called an overlay. All writes

to a EWF-protected volume (the hard disk in the following figure) are only recorded on this virtual overlay (the

EWF Volume in the following figure), which is stored independently in random access memory (RAM).

Because EWF does not write data directly to the hard disk but instead only records system writes to this virtual

RAM overlay, any data that is “written” during system operation will disappear upon the next re-boot. This

approach allows the system to operate as if it is writeable when in reality all OS and user-space file systems are

stored in a permanent, read-only state.

If required, data written to the overlay can be committed to the protected volume, but this requires additional

setup and permissions that can only be granted by the administrator.

The following figure shows an overview of the EWF structure.

For more detailed information about EWF configuration and usage, refer to the following resources:

• Visit Microsoft’s EWF Volume Configuration

help pages.

• See Microsoft’s EWF overview on the official Microsoft EWF help pages.

• See Microsoft’s detailed description of EWF modes on the EWF help pages.

• See Microsoft’s detailed description of the EWF API.

• For EWF commands, refer to the MSDN web site:

http://msdn.microsoft.com/en-us/library/ms940853%28v=winembedded.5%29.aspx