Enhanced Write Filter

Enhanced Write Filter (or EWF) is a component of Windows XP Embedded that basically sits between the software and hardware and listens for any writes to a volume, and filters them to another medium instead of being physically written to the volume itself. [ [http://msdn.microsoft.com/en-us/library/ms912906.aspx Enhanced Write Filter ] ] You can choose (through either action or inaction) to commit the writes to the physical volume later. One of its (primary) operating modes is called "RAM (REG)", which means that writes are stored in memory, and the settings are stored in the system registry. So, if you write a file (say, by downloading it), EWF begins to consume memory needed to "write" the file (it's not written to the drive, though it appears to be there). If you erase that file, memory may or may not be freed (not sure how EWF handles that), but if the file is rewritten, more memory doesn't need to be claimed because it reuses the original memory. You can even defragment a drive with EWF enabled, committing the changes (and then rebooting) as you go.

Since EWF is a component of Windows XP Embedded, which in turn is a broken-up implementation of Windows XP Professional, EWF can be installed on a computer running an off-the-shelf version of Windows XP as well [ [http://granturing.blogspot.com/ GranTuring ] ] .

"ewfmgr" is the command dedicated to the EWF component.

References