Table of Contents
Advertisement
If EWF is activated, data is not stored to the flash. The data stored in the cache is only effective while the client is operating.
The cached data will be lost when restarting or shutting down your client. Therefore, to store the data written to the registry,
favorites and cookie folders, etc., the content stored in the cache should be transferred to the flash. An error message is
displayed when it is not possible to write to the cache due to a lack of memory. If this message is displayed, you have to
deactivate EWF to flush the EWF cache. The user can double-click the EWF icon on the tray at the bottom right of the screen
to call the EWF Manager. A user can also change the EWF configuration by entering EWF management commands at the
command prompt. This task requires the Administrator privilege.
•
Enable write filter and restart the system.
If the EWF is disabled, enable it. If this item is selected, the cache is flushed and the EWF is enabled. After restarting your
computer, the configurations and file system information for the client are written to a cache. You can also perform this
operation by entering "ewfmgr.exe c: -enable" at the command prompt and restarting your computer.
•
Disable write filter and restart the system.
This item is activated when the EWF is running. If this item is selected, the current states of the client (saved in a cache)
are saved to a flash volume and the EWF is disabled. After restarting your computer, the configurations and file system
information for the client are written to a flash volume. You can also perform this operation by entering "ewfmgr.exe c: -
commitanddisable" at the command prompt and restarting your computer.
•
Commit changes to disk.
This item is activated when the EWF is running. If this item is selected, the current states of the client (saved in a cache)
are saved to a flash volume. However, the state of EWF will not be changed. You can also perform this operation by
entering "ewfmgr.exe c: -commit" at the command prompt.
You can view the configurations for the protected volumes by entering "ewfmgr.exe c:" at the command prompt.
File-Based Write Filter (FBWF)
The File-Based Write Filter (FBWF) protects the memory of the client from being overwritten by any unauthorized user. By
restricting excessive writing into the memory, the FBWF allows you to use the client for a long time. If you request I/O, the
FBWF has the client perform its operations using the cache instead of the memory so that the memory can be protected.
The data saved in the cache is preserved while the client operates normally. It is removed when it is restarted or exited. To
save the changes, you should write the relevant file onto the disk using the commit command. If you don't know which file is
changed, disable the FBWF, change it, and enable it again.
You can control the FBWF using the various options of the command at a command prompt.
•
FBWF Configuration
•
Current FBWF status : Displays the current status of the FBWF (Enabled or Disabled).
•
Boot command : Displays the FBWF command that will be performed at the next boot-up.
•
RAM Used by FBEF : Displays the size of the RAM the FBWF is using. If the current status is set to "Disabled", the
used memory is displayed as 0 KB.
•
Threshold : Displays the maximum size of the RAM that the FBWF can use.
•
FBWF Command
4-1
Installing the Software
Hide quick links:
Advertisement
Table of Contents
