You can use the Enhanced Write Filter (EWF) feature to
protect one or more partitions on a removable media such as compact flash (CF)
cards. For example, you might want to protect the operating system (OS) image
from any changes. This article describes how to set EWF on a removable media
and lists some of the issues that you might experience.
Note The OS cannot mount a partition on a removable media as it can
with media that is reported as fixed (for example, hard disks). Becauseyou have
to create an EWF partition when you set up EWF, you have to treat removable
Note Although CF cards are used as an example of removable media, the
same steps and issues in this article apply equally to all other types of
CF cards are typically reported to the OS as
removable media unless the manufacturer provides a tool that you can use to
convert the CF cards to fixed media.
Removable. You have to do step 2 (shown later in this section) only for
removable CF cards.
Fixed. For fixed CF cards, you can directly copy the pre-FBA image onto
the CF card and let FBA run on it (exactly the same way as with hard disks).
Before you build, make sure that you set the following
correctly in Target Designer:
Make sure that the EWF components are included and that
the EWF settings are set appropriately.
Among these settings, clear
the Start EWF Enabled check box, and then make sure the
EWF Partition Size in Kbytes field in theEnhanced
Write Filter component is set to an appropriate value. For RAM-based
overlays, 32 KB or larger is acceptable.
You do not have to include the El Torito component in the configuration, nor do you use the Etprep.exe
tool (see step 2).
Enter a value in the Boot Partition
Size field in Target Device Settings of the root
node. This value is the size of the CF boot partition (for example, 300
To set EWF on CF cards, follow these steps:
Use a separate disk drive (for example, disk drive
X) to hold the temporary image that you later copy to the CF
card. In other words, use a different drive from the main drive on your
Make sure that drive X has a primary
partition (that has sufficent space to hold the embedded OS image) and has sufficient
unallocated space (raw space) for the EWF partition to be created (as specified
by the EWF Partition Size in KBytes field in the EWF
properties). Delete any existing EWF partitions (reported as non-dos partition
Note EWF might not successfully create or open its partition on a disk drive that has an extended partition with a logical drive defined in that extended partition, even if there is enough unallocated space on the disk drive. If this occurs, make sure that only primary partitions exist on the drive (and, of course, enough unallocated space, too).
Plug in drive X into the development
On the development computer, build the configuration,
and then copy the image to drive X.
Move drive X to the target boot
computer to drive X, and then let FBA run until it has
Verify whether the EWF was set up correctly on the
target runtime on drive X: after you log on, run the following
command and then look at the output for any errors: type
(This command assumes that drive C is the protected
Move drive X and the CF card to the
development computer, and then copy the post-FBA image from
drive X to the CF card (use either xcopy or
the drag-and-drop method).
Make sure that the CF card was already set
up, that is, partitioned (using Fdisk.exe), formatted (using Format.exe), and
"bootprep'd" to make it bootable in Windows XP.
Move the CF card to the primary master integrated
development environment (IDE) channel on the target computer, and then start
the system from the CF card.
Issues When Using EWF on Removable Media
You might experience the following issues when using EWF on
The FBA log might indicate an error when creating or
opening the EWF partition.
If you typeewfmgr in the runtime,
the following message appears (this is expected behavior because you cannot
mount partitions on a removable media):
locate EWF partition
When you type ewfmgr c: to check the
status of the protected volume, everything looks fine, except for the next boot
command. This next boot command line is missing from the output and there is no
way to determine what is the next boot command.
or disabling RAM-based EWF is supported only in Enhanced Write Filter (EWF) SP1
version. However, to disable EWF, you must also commit as part of the
disabling process. A commit is required to flush the disable registry key to disk
so that the EWF will recognize it the next time that the computer starts.
RAM-based EWF on SP1 systems, follow these steps:
Run the ewfmgr c: -disable command.
Run the ewfmgr c: -commit command.
Restart the computer
When to Use the EtPrep Tool
If you do not plan to use the hard disk (drive X) that
the FBA ran on on your target OS (for example, as a secondary storage media or
to hold the paging file), you do not have to swap drive letters. Therefore, you
also do not need Etprep.
In this case, after the system starts and
finds that the CF card is the only volume on the computer, the system assigns
the CF card to drive C, even though this letter was previously
mapped to the hard disk. This drive assignment occurs because the hard disk
volume no longer exists. Therefore, drive C is re-assigned to
the CF card and the CF card works fine.
However, if you use the same hard disk on the computer,
and if you do not explicitly swap the drive letters, the system cannot assign
drive C to the CF card. Because the image was built for drive
C, you cannot start the computer from the CF drive.
Despite this list of issues, you can expect EWF to work fine.
To easily test EWF, follow these steps:
Enable EWF: run the ewfmgr c: -enable command.
Restart the computer.
Modify something in the OS image.
Restart the computer again.
Verify that the modifications that you made in step 3 do