Moxa TC-6110-T-LX [10/74] Enhanced write filter

TC-6110 / Windows 7 Enabling Windows 7 Write Protections

3-2

Enhanced Write Filter

Overview

Enhanced Write Filter (EWF) allows Windows 7 users to protect their all information on their storage drive

from permanent changes of any sort, at the lowest level of hardware protection available: the bit level. EWF

allows the operating system (OS) to boot from the hard disk, but protects the system by creating a virtual file

system called an overlay. All writes to an EWF-protected volume (the hard disk, in Fig. 1) are only recorded

on this virtual overlay (the EWF Volume, in Fig. 1), which is stored independently in random access memory

(RAM). Because EWF does not write data directly to the hard disk but instead only records system writes to this

virtual RAM overlay, any data that is “written” during system operation will disappear upon the next re-boot.

This approach allows the system to operate as if it is writeable when in reality all OS and user-space file

systems are stored in a permanent, read-only state. If desired, the data written to the overlay may be

committed to the protected volume, but this requires additional effort. Refer to the following figure (from

Microsoft) for an overview of the EWF structure.

To get more details about EWF configuration and usage, you may:

• Visit Microsoft’s

EWF Volume Configuration help pages.

• Visit Microsoft’s

EWF overview on the official Microsoft EWF help pages.

• Visit Microsoft’s detailed description of

EWF modes on the EWF help pages.

• Visit Microsoft’s detailed description of the

EWF API.