Enhance Write Filter

Enhance Write Filter (EWF) is used to protect disk volumes by intercepting write requests and redirecting them to an overlay volume (such as RAM or another disk).

The Ivanti Device and Application Control Client running with EWF enabled is able to pick up all permissions, including managed devices and temporary permissions, from the server after a reboot. EWF can be activated or deactivated from within the Control Panel.

Enhance Write Filter provides the following functionality:

• Write protects one or more partitions on your system.
• Enables read-only media, such as CD-ROM or flash to boot and run.

Enhance Write Filter consists of two major components:

• EWF Overlay: EWF protects the contents of a volume by redirecting all write operations to an alternative storage location.
• EWF Volume: An EWF volume is created on the media in an un-partitioned disk space. This EWF volume stores configuration information about all EWF–protected volumes on the device

There are three different modes of EWF, depending upon the different configurations of the EWF Overlay and EWF Volume. These modes are as follows:

• Disk on Disk: Used to maintain the state of the system between reboots. The EWF volume is created on disk in an un-partitioned space.
• RAM in RAM: Utilized to discard any write information after reboot or to delay writing the overlay to the media. The EWF volume is created on disk in an un-partitioned space.
• RAM Reg in RAM: Similar to EWF RAM types, RAM Reg overlays stores information in RAM. However, the configuration information about EWF is not stored in a separate EWF volume, but within the registry.