UWF overlay contains files on my exclusion list

Question

I have enabled UWF but added exclusions for several directories on the protected drive.

However, I'm finding that when I inspect the files in the overlay it contains files that are in those directories.

I would have thought that since these files are excluded and therefore written directly to the disk, they wouldn't be in the overlay. Is this correct?

According to Microsoft documentation on uwf exclusions

When a file or folder is in the exclusion list for a volume, all writes to that file or folder bypass UWF filtering, and are written directly to the protected volume and persist after the device restarts.

This is causing me problems because I have excluded directories where I know large files will be written, however because they're being written to the overlay anyway, the overlay is exceeding its maximum size.

Is there a way to prevent excluded files from being written to the overlay?

Answer 1

This is a known issue. File Based Write Filter works as you describe: all writes are made to the disk and not the overlay. UWF has a different architecture than the old FBWF or EWF. As a result of this new architecture, you open the holes, but all writes to the unprotected files and folders are still written to the overlay. These get cleared out of the overlay on reboot, but the files remain on the disk. I call this the UWF quirk.

The problem has been reported, but this is how the UWF works. It is not going to get changed any time soon. The quirk is a problem for big files since there is limited overlay space. The solution is to use the open holes in the protected system are limited to small files like log files, and use an unprotected second partition for big data files.

And yes, this was discussed in my book.

-Sean Liming

Answer 2

Hi,

Just checking in to see if the information provided was helpful.
if yes, you may mark useful reply as answer, if not, welcome to feedback.

Best regards,
Molly

--------------------------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.