EwfMgrSetLevel (Standard 7 SP1)

7/8/2014

This function sets the overlay level on an Enhanced Write Filter (EWF)-protected volume for disk overlays.

Syntax

BOOL EwfMgrSetLevel(
  HANDLE hDevice,
  OPTIONAL LPCWSTR lpDescription,
  int Level,
  BOOL fDeleteLevel
);

lpDescription
[in] Long pointer to an optional description to associate with the new overlay level. This optional description can contain up to EWF_MAX_LEVEL_NAME_LENGTH characters. If the length is equal to EWF_MAX_LEVEL_NAME_LENGTH, no null terminator is stored. This parameter is optional, and can be set to NULL. This parameter is ignored unless Level is equal to current level + 1.

Level
[in] Describes the level to set as the new overlay level. The following table shows the possible values.

Value	Description
current_level +1	Starts a new overlay at Level. The value of Level must be less than or equal to MaxLevels, as specified by EwfMgrGetProtectedVolumeConfig.
0	Discards all overlay data and sets the level to 1.
1 through current_level	Sets the level to Level, discarding all data above the specified level.

If Level is current_level +1, EWF adds an overlay. If Level is less than the current_level, EWF deletes overlay levels.

fDeleteLevel
[in] If TRUE, all data in and above the specified level is deleted.

If the function succeeds, the return value is TRUE.

If the function fails, the return value is FALSE. Call GetLastError for extended error information.

The level is set on the next restart.

This function is only supported on disk overlays.

The DoEwfSetLevel function included in EWF API Code Sample (Sample.cpp) shows you how to use the EwfMgrSetLevel function.

OS Versions: Standard 7

Header: Ewfapi.h

Link Library: Ewfapi.lib