Enhanced Write Filter

From Wikipedia, the free encyclopedia

Enhanced Write Filter (or EWF) is a component of Windows XP Embedded and Windows Embedded Standard 7 which stores volume changes on another medium instead of applying them to the original volume.[1] EWF allows the writes to be discarded or committed to the original volume later (either directly or through inaction based on the configuration). As this minimizes writes to a specified hard disk, EWF and FBWF (File-Based Write Filter)[2] have become popular in enthusiast computing as a way of decreasing wear of solid-state drives on netbooks and CarPCs.

Operating modes

EWF has three main operating modes: EWF Disk, EWF RAM, and EWF RAM Reg. In each mode, the location of the EWF volume (which stores the configuration) and the overlay volume (which stores file changes) is different. EWF Disk stores the overlay data outside the primary disk, allowing an external disk such as a CompactFlash to be used as an overlay. The EWF volume is stored in an unpartitioned space on the disk. EWF RAM stores the overlay data in the RAM and the EWF volume in an unpartitioned space on the disk. EWF RAM Reg is same as EWF RAM except the EWF volume is stored in Windows Registry.

Use in Windows Vista

As is the case with the appropriation of EWF in CarPCs, which are more often based on Windows XP because of its smaller "footprint," it has been used with similar effect in Windows Vista NetBooks to diminish write activity to, and so enhance the lifespan of Solid State Drives. Due to changes in Windows Vista, however, the Disk Mode can not be used.

Resurgence in non embedded Windows 7 and versions since

Enthusiasts have successfully tested and implemented EWF in Windows 7 Home and subsequent versions including the latest versions of Windows 10 and Server 2016. The same robust disk protection of Windows 10 Professional is ostensibly backwards compatible through Windows 7 Starter. Microsoft's use of shared code makes this feasible since EWF.sys is a low level boot time driver deemed compatible with corresponding non embedded kernels.[3]

Potential pitfalls

Unlike most commercial RAM disks, EWF cannot reclaim the RAM after files have been deleted from it. In EWF RAM (and EWF RAM Reg) mode, the memory consumed only ever increases. Eventually the system will have no more free space and will crash.[4]

Automatic adjustment of daylight saving time is not compatible with EWF, causing incorrect time settings at each reboot.[5]


  1. ^ Enhanced Write Filter
  2. ^ File-Based Write Filter
  3. ^ [http://ShatterProofWindows.blogspot.com
  4. ^ EWF RAM Mode
  5. ^ Write Filters and Automatic Adjustment of Daylight Saving Time (Standard 7 SP1)
Retrieved from "https://en.wikipedia.org/w/index.php?title=Enhanced_Write_Filter&oldid=772725968"
This content was retrieved from Wikipedia : http://en.wikipedia.org/wiki/Enhanced_Write_Filter
This page is based on the copyrighted Wikipedia article "Enhanced Write Filter"; it is used under the Creative Commons Attribution-ShareAlike 3.0 Unported License (CC-BY-SA). You may redistribute it, verbatim or modified, providing that you comply with the terms of the CC-BY-SA