Enhanced Write Filter

Enhanced Write Filter (or EWF) is a component of Windows XP Embedded and Windows Embedded Standard 7 which stores volume changes on another medium instead of applying them to the original volume.^[1] EWF allows the writes to be discarded or committed to the original volume later (either directly or through inaction based on the configuration). As this minimizes writes to a specified hard disk, EWF and FBWF (File-Based Write Filter)^[2] have become popular in enthusiast computing as a way of decreasing wear of solid-state drives on netbooks and CarPCs.

Operating modes

EWF has three main operating modes: EWF Disk, EWF RAM, and EWF RAM Reg. In each mode, the location of the EWF volume (which stores the configuration) and the overlay volume (which stores file changes) is different. EWF Disk stores the overlay data outside the primary disk, allowing an external disk such as a CompactFlash to be used as an overlay. The EWF volume is stored in an unpartitioned space on the disk. EWF RAM stores the overlay data in the RAM and the EWF volume in an unpartitioned space on the disk. EWF RAM Reg is same as EWF RAM except the EWF volume is stored in Windows Registry.

Use in Windows Vista

As is the case with the appropriation of EWF in CarPCs, which are more often based on Windows XP because of its smaller "footprint," it has been used with similar effect in Windows Vista NetBooks to diminish write activity to, and so enhance the lifespan of solid-state drives (SSD). Due to changes in Windows Vista, however, the Disk Mode can not be used.

Potential pitfalls

Unlike most commercial RAM disks, EWF cannot reclaim the RAM after files have been deleted from it. In EWF RAM (and EWF RAM Reg) mode, the memory consumed only ever increases. Eventually the system will have no more free space and will crash.^[3]

Automatic adjustment of daylight saving time is not compatible with EWF, causing incorrect time settings at each reboot.^[4]