Reference Guide

The EWF interface includes the following buttons:
●
Enable/Disable EWF
Enables the Enhanced Write Filter so that data written to the protected media is cached in the
overlays. Disables the overlay on the specified protected volume.
●
Overlay Configuration
Displays the overlay information and is a combination of the information supplied when
executing ewfmgr.exe c: -Description and ewfmgr.exe c: -Gauge from the DOS
prompt.
●
Clear Boot Command
Clears the boot command from the DOS prompt.
●
Commit Data to Volume
Commits all current-level data in the overlay to the protected volume, and resets the current
overlay value to 1.
Using the Enhanced Write Filter status utility
The EWF status utility creates an icon in the notification area of the taskbar that shows the status of
the filter. You can right-click the icon to display and execute the available options.
The EWF Status icon displays the following states:
● Red lock: EWF is disabled.
● Green lock: EWF is enabled.
●
Yellow lock: EWF state will change on next boot.
If you are logged on as an administrator, you can change the status of EWF by right-clicking the icon
and selecting the desired EWF state.
NOTE: Because the ewfmgr.exe utility and the EWF status service execute separate code, status
changes by ewfmgr.exe are not automatically reflected by the EWF status icon.
If you use the command line to modify the EWF, right-click the icon to refresh the status icon display
(click anywhere on the screen to close the context menu). The status icon display is refreshed
automatically when you make modifications through the EWF Control Panel utility. The EWF utility
always reflects the current status.
Enhanced Write Filter 7