How to use Enhanced Write Filter (EWF) on removable media (814257)


The information in this article applies to:

  • Microsoft Windows XP Embedded
  • Microsoft Windows XP Embedded SP1

SUMMARY

You can use the Enhanced Write Filter (EWF) feature to protect one or more partitions on a removable media such as compact flash (CF) cards. For example, you might want to protect the operating system (OS) image from any changes. This article describes how to set EWF on a removable media and lists some of the issues that you might experience.

Note The OS cannot mount a partition on a removable media as it can with media that is reported as fixed (for example, hard disks). Becauseyou have to create an EWF partition when you set up EWF, you have to treat removable media differently.

MORE INFORMATION

Note Although CF cards are used as an example of removable media, the same steps and issues in this article apply equally to all other types of removable media.

CF cards are typically reported to the OS as removable media unless the manufacturer provides a tool that you can use to convert the CF cards to fixed media.
  • Removable. You have to do step 2 (shown later in this section) only for removable CF cards.
  • Fixed. For fixed CF cards, you can directly copy the pre-FBA image onto the CF card and let FBA run on it (exactly the same way as with hard disks).
  1. Before you build, make sure that you set the following correctly in Target Designer:
    1. Make sure that the EWF components are included and that the EWF settings are set appropriately.

      Among these settings, clear the Start EWF Enabled check box, and then make sure the EWF Partition Size in Kbytes field in theEnhanced Write Filter component is set to an appropriate value. For RAM-based overlays, 32 KB or larger is acceptable.
    2. You do not have to include the El Torito component in the configuration, nor do you use the Etprep.exe tool (see step 2).
    3. Enter a value in the Boot Partition Size field in Target Device Settings of the root node. This value is the size of the CF boot partition (for example, 300 megabytes [MB]).
  2. To set EWF on CF cards, follow these steps:
    1. Use a separate disk drive (for example, disk drive X) to hold the temporary image that you later copy to the CF card. In other words, use a different drive from the main drive on your development computer.
    2. Make sure that drive X has a primary partition (that has sufficent space to hold the embedded OS image) and has sufficient unallocated space (raw space) for the EWF partition to be created (as specified by the EWF Partition Size in KBytes field in the EWF properties). Delete any existing EWF partitions (reported as non-dos partition in Fdisk.exe).

      Note EWF might not successfully create or open its partition on a disk drive that has an extended partition with a logical drive defined in that extended partition, even if there is enough unallocated space on the disk drive. If this occurs, make sure that only primary partitions exist on the drive (and, of course, enough unallocated space, too).
    3. Plug in drive X into the development computer.
    4. On the development computer, build the configuration, and then copy the image to drive X.
    5. Move drive X to the target boot computer to drive X, and then let FBA run until it has completed.
    6. Verify whether the EWF was set up correctly on the target runtime on drive X: after you log on, run the following command and then look at the output for any errors: type

      ewfmgr c:

      (This command assumes that drive C is the protected partition.)
    7. Move drive X and the CF card to the development computer, and then copy the post-FBA image from drive X to the CF card (use either xcopy or the drag-and-drop method).

      Make sure that the CF card was already set up, that is, partitioned (using Fdisk.exe), formatted (using Format.exe), and "bootprep'd" to make it bootable in Windows XP.
    8. Move the CF card to the primary master integrated development environment (IDE) channel on the target computer, and then start the system from the CF card.

Issues When Using EWF on Removable Media

You might experience the following issues when using EWF on removable media:
  • The FBA log might indicate an error when creating or opening the EWF partition.
  • If you type ewfmgr in the runtime, the following message appears (this is expected behavior because you cannot mount partitions on a removable media): Unable to locate EWF partition
  • When you type ewfmgr c: to check the status of the protected volume, everything looks fine, except for the next boot command. This next boot command line is missing from the output and there is no way to determine what is the next boot command.
  • Enabling or disabling RAM-based EWF is supported only in Enhanced Write Filter (EWF) SP1 version. However, to disable EWF, you must also commit as part of the disabling process. A commit is required to flush the disable registry key to disk so that the EWF will recognize it the next time that the computer starts.

    To disable RAM-based EWF on SP1 systems, follow these steps:
    1. Run the ewfmgr c: -disable command.
    2. Run the ewfmgr c: -commit command.
    3. Restart the computer
  • When to Use the EtPrep Tool
    • If you do not plan to use the hard disk (drive X) that the FBA ran on on your target OS (for example, as a secondary storage media or to hold the paging file), you do not have to swap drive letters. Therefore, you also do not need Etprep.

      In this case, after the system starts and finds that the CF card is the only volume on the computer, the system assigns the CF card to drive C, even though this letter was previously mapped to the hard disk. This drive assignment occurs because the hard disk volume no longer exists. Therefore, drive C is re-assigned to the CF card and the CF card works fine.
    • However, if you use the same hard disk on the computer, and if you do not explicitly swap the drive letters, the system cannot assign drive C to the CF card. Because the image was built for drive C, you cannot start the computer from the CF drive.
Despite this list of issues, you can expect EWF to work fine. To easily test EWF, follow these steps:
  1. Enable EWF: run the ewfmgr c: -enable command.
  2. Restart the computer.
  3. Modify something in the OS image.
  4. Restart the computer again.
  5. Verify that the modifications that you made in step 3 do not persist.
Modification Type:MinorLast Reviewed:6/21/2004
Keywords:kbhowto KB814257 kbAudDeveloper kbAudOEM
©2004 Microsoft Corporation. All rights reserved.