Configuring EWF Disk Mode

EWF Disk mode stores EWF Overlay data and the EWF volume on a local hard disk. During the First Boot Agent (FBA) phase, EWF creates the EWF partition, which contains both the EWF volume and EWF Overlay.

To configure EWF Disk mode

1. If you are using FAT16-formatted media, you must use BootPrep to prepare the media. BootPrep updates the boot sector that MS-DOS generated. This allows the media to boot the Windows XP bootloader instead of the MS-DOS bootloader. For more information, see BootPrep. If you are deploying to an NTFS-formatted or FAT32-formatted CompactFlash file system, you do not need to use BootPrep.

2. Create a working configuration in Target Designer. To create a configuration, follow the steps that are provided in Tutorial: Building and Deploying a Run-Time Image.

3. Add the following components to your configuration:

   • Background Disk Defragmentation Disable
   • Enhanced Write Filter
   • EWF Manager Console Application
   • EWF NTLDR
   • Registry Editor (optional)

4. Expand the Enhanced Write Filter node in the configuration browser pane and select Settings. The EWF Configuration Settings appear in the details pane.

5. Change the following default settings for the Enhanced Write Filter:

   • Set the EWF Partition size to the size that you want the EWF partition to be, in kilobytes.
   • Select the Start EWF Enabled check box.
   • In the Disk Number field, type the disk number that contains the volume that you want to protect.
   • In the Partition Number field, type the partition number for the volume that you want to protect.
   • In the Disk Type field, select the disk type to use, either IDE or SCSI.
   • Set the Overlay Type to DISK.

6. Add command-line support to your run-time image. If you are using the Explorer shell, enable support for the Run command on the Start menu:

   1. Expand the User Interface Core component in the configuration browser and choose Settings. The User Interface Core settings appear in the details pane.
   2. Select Show Run on Start Menu.

7. Check dependencies and build the run-time image.

   1. Choose Check Dependencies from the Configuration menu. Resolve missing dependencies.
   2. Build the run-time image. Choose Build Target Image from the Configuration menu.

8. Deploy the run-time image and boot the device. Using Disk EWF mode requires additional space on the hard drive that you are planning to deploy to. The amount of space that is required for EWF Disk mode varies. This requirement depends on the number of write operations that are made to the system. The maximum size for the EWF overlay is the same size as the protected volume. Additionally, the minimum size of the EWF partition that will be created is 32 MB.

   During FBA, Ewfdll.dll reads the configuration parameters from the registry. Ewfdll.dll creates the EWF partition, and formats it according to configuration parameters. The EWF partition contains both the EWF volume and the EWF Overlay. The disk overlay volume is as large as, or larger than, the total size of all protected volumes.

   After the final FBA reboot, EWF searches for the EWF volume on the local computer.

   If the EWF volume is detected, it is inspected by EWF. EWF then configures itself and executes any pending EWF commands in the volume, such as the commit command. If no EWF volume is found, EWF disables itself.

9. Verify that EWF is properly configured by typing the following command from a command prompt:

   ewfmgr c:
   

   EWF Manager should report that EWF is enabled and provide a current status of the EWF overlay.

If an EWF partition has already been created on the disk, the FBA process may endlessly reboot. For more information, see Troubleshooting Enhanced Write Filter.

See Also

EWF Modes | Troubleshooting Enhanced Write Filter | EWF Performance Considerations

Last updated on Wednesday, October 18, 2006

© 2006 Microsoft Corporation. All rights reserved.