EWF Components (Standard 7 SP1)
7/8/2014
The Enhanced Write Filter (EWF) feature uses the following components to protect a run-time image.
Enhanced Write Filter with HORM Package
The Enhanced Write Filter with HORM package contains files and settings that are required to run the Enhanced Write Filter. The Enhanced Write Filter with HORM package includes the following components and files:Ewf.sys
The filter driver that intercepts read and write requests to the protected volume and returns the appropriate data, whether from the overlay stack, or from the protected volume. For more information, see EWF Architecture.Ewfcfg.exe
This is the generic command executable for the Enhanced Write Filter with HORM component and is run during component install or servicing. The executable functions as a proxy to Ewfcfg.dll which handles all setup related issues.Ewfcfg.dll
EWF settings specified in Image Configuration Editor are stored in an answer file. This configuration DLL consumes the answer file during setup, servicing, or Sysprep and applies any customizations required of the component. Additionally, the DLL is used to facilitate various non-settings related component configuration such as hardware discovery and system component layout.EWF Manager Console Application
Ewfmgr.exe is used to issue a set of commands to the Enhanced Write Filter (EWF) driver, to report the status of each protected volume, and to report the format of the overall EWF configuration.
For information about the command syntax of EWF manager, EWF Manager.Enhanced Write Filter API (Ewfapi.dll)
The EWF API is the library needed during runtime to support custom applications that interact with EWF.Horm.dat
The configuration file that tracks the HORM state and the EWF state with respect to the BCD volume.Warning
The horm.dat file should not be modified or moved around by the end user. It is solely intended to be modified by the EWF driver.
Enhanced Write Filter Boot Environment Package
The Enhanced Write Filter with HORM Package depends on the Enhanced Write Filter Boot Environment package. The Enhanced Write Filter Boot Environment is a modified, HORM-aware version of the Windows 7 Boot environment that interprets the EWF overlay mapping structures and can access the most recent snapshot of the disk. The modified Boot Environment also uses all cached disk write operations that are stored in the volume as part of loading the operating system. This makes it possible to boot from the protected volume. In addition, any updates to boot drivers or registry keys persist after reboots.Warning
The Enhanced Write Filter with HORM package depends on the Enhanced Writer Filter Boot Environment which conflicts with the Windows Boot Environment. You may run into this conflict under certain circumstances. For example, if you create a basic runtime image with eCore and choose to resolve dependencies, you are prompted to select either Windows Boot Environment or Write Filter Boot Environment as a required dependency. You select Windows Boot Environment and deploy the image. Later, you create a configuration set with Enhanced Write Filter with HORM and you add the Enhanced Write Filter Boot Environment because it is a required dependency. When you attempt to perform an online update of your image using Deployment Image Servicing and Management Command-Line Options and your configuration set, the installation will fail because of the conflict between the Enhanced Writer Filter Boot Environment and the Windows Boot Environment.