Protect Multiple Volumes By Using RAM Reg Mode (Standard 8)
7/8/2014
Learn how to protect multiple volumes using Enhanced Write Filter (EWF) RAM Reg mode on your Windows Embedded 8 Standard (Standard 8) device.
You can extend Enhanced Write Filter (EWF) RAM Reg overlays to protect multiple volumes on a device by setting RAM Reg mode for each volume you want to protect.
To protect multiple volumes by using RAM Reg mode
Configure EWF as described in Configure EWF RAM Reg Mode.
Expand the Lockdown node in the configuration file pane, and then select Enhanced Write Filter. The EWF configuration settings appear in the settings pane
Change the following default settings for the EWF module:
- In the Filter view by box, select 4 Specialize.
- In the EWFMode box, select RamReg.
- Identify all volumes you want to protect using the ProtectedVolumes property of the EWF module.
Notes
When protecting multiple volumes using EWF RAM Reg mode, you only have to commit the overlay to the partition where the Registry is stored. For example, if you had two protected partitions, C: and D:, you would use the EWF Manager command to disable the overlay on D:, and then commit the changes to the registry on C:.
ewfmgr d: -disable
ewfmgr c: -commit
Important
You must restart the system in this scenario because the overlay is written to the protected volume on the next system restart.