question

ColmdeCleir-9677 avatar image
0 Votes"
ColmdeCleir-9677 asked JonathanArciaga-3717 commented

UWF overlay contains files on my exclusion list

I have enabled UWF but added exclusions for several directories on the protected drive.

However, I'm finding that when I inspect the files in the overlay it contains files that are in those directories.

I would have thought that since these files are excluded and therefore written directly to the disk, they wouldn't be in the overlay. Is this correct?

According to Microsoft documentation on uwf exclusions

When a file or folder is in the exclusion list for a volume, all writes to that file or folder bypass UWF filtering, and are written directly to the protected volume and persist after the device restarts.

This is causing me problems because I have excluded directories where I know large files will be written, however because they're being written to the overlay anyway, the overlay is exceeding its maximum size.

Is there a way to prevent excluded files from being written to the overlay?


windows-10-general
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Did you need further assistance?

0 Votes 0 ·
Sean-Liming avatar image
1 Vote"
Sean-Liming answered JonathanArciaga-3717 commented

This is a known issue. File Based Write Filter works as you describe: all writes are made to the disk and not the overlay. UWF has a different architecture than the old FBWF or EWF. As a result of this new architecture, you open the holes, but all writes to the unprotected files and folders are still written to the overlay. These get cleared out of the overlay on reboot, but the files remain on the disk. I call this the UWF quirk.

The problem has been reported, but this is how the UWF works. It is not going to get changed any time soon. The quirk is a problem for big files since there is limited overlay space. The solution is to use the open holes in the protected system are limited to small files like log files, and use an unprotected second partition for big data files.

And yes, this was discussed in my book.

-Sean Liming

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hello Sean,

Is this still the case where UWF hasn't changed with this quirk? We have a kiosk type application where it will create data that is in the GB and over a couple of uses, the overlay fills up. Rebooting the system is unacceptable and becomes incredibly difficult to be done in a safe manner due to the OS becoming unbearably slow. Power cycling is not a option.

We originally had the ProgramData in a separate drive (D drive), but that would work on Windows 7 with EWF. With Windows 10, we encountered way too many issues trying to move the ProgramData to the D drive so we moved it back to the C drive. Doing so, and having UWF on, would cause the bogging down so we disabled UWF till we can find a solution.

-Jon Arciaga

0 Votes 0 ·
MollyLu-MSFT avatar image
0 Votes"
MollyLu-MSFT answered

Hi,

Just checking in to see if the information provided was helpful.
if yes, you may mark useful reply as answer, if not, welcome to feedback.

Best regards,
Molly


If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.