Write Filters – share your experience with us

I’m a program Manager with the Windows Embedded Standard team working on the write filters – Enhanced Write Filter (EWF), File Based Write Filter (FBWF), and Registry Filter. I have been with Microsoft for almost 9 years, but just joined the Embedded team last year to work on the next version of Embedded systems based on Windows 7 codename ‘Quebec’.

Write filters are part of the Embedded Enabling Features (EEFs) that enable the Embedded Windows community to protect their disks. They bring a wide variety of benefits including system resilience and reliability, stateless device operation, fast reboot capabilities with Hibernate Once Resume Many (HORM), and reducing wear on flash devices. The Disk protection in Windows Embedded Standard more than just a useful feature blog provides an overview of the write filters and corresponding benefits. Additionally, the write filters provide configuration and management utilities both at image creation and runtime. The Managing Disk Protection blog provides an overview for both configuration and runtime management. On the other hand, the great benefits of these features sometimes come at a cost, as they may interfere with the functionality of some other feature in the system especially those that require persistent write to the disk; servicing is a classical example as you currently cannot service a system that is protected by a write filter, unless you turn off the filter before servicing then turn it on again after you are done.

That said, we want to hear back from you about your experience, scenarios, pain points, and suggestions for the write filters. Your feedback is essential to direct our design more towards your scenarios and adapt our development to fulfill your requirements. Although I can’t commit to accommodating all suggestions, issues and/or problems in our upcoming release, I’ll make sure that this feedback becomes part of our core requirements and design considerations for subsequent releases.

Thank you for reading my first posting and I’m looking forward to having useful postings and productive discussions on this blog.


Comments (22)

  1. Daniel Meier says:

    I’m using FBWF to protect flash devices.

    For me there are some important parts still missing:

    – a service to control the overlay. It should do some configurable tasks on low memory. e.g. reboot

    – a service or change of the interface to allow non admins to commit some files (e.g. via context menu in Explorer)

    – the possibility to commit all changes in the overlay to disk and free all memory

    Registry Filter is nearly useless, because it starts to late. Try to add TCP/IP settings to the RegFilter.

    It’s mere chance which settings will be used.

  2. Abdelkader says:

    Hi Daniel,

    Thank you for providing this valuable feedback.  I wanted to get some clarification on a couple of points from your comments.  Thanks.

    – a service to control the overlay. It should do some configurable tasks on low memory. e.g. reboot

    Would an interface (API) be enough for this purpose?  This way we are giving OEMs the flexibility to create their own applications according to their actual need.  

    OR are you looking for a runtime app/service? If so, how would you like it to operate e.g. notify user, reboot…etc?  Should it be configurable at runtime or just during image creation?

    – a service or change of the interface to allow non admins to commit some files (e.g. via context menu in Explorer)

    Would you please elaborate on this scenario?  I would be more in favor of using the exclusion list than allowing non-administrators to commit files in different parts of an FBWF protected system.  This way we can limit non-admins access to only pre-specified set of files/directories (which are within their exclusion list).

    – Registry Filter is nearly useless, because it starts to late. Try to add TCP/IP settings to the RegFilter.

    It’s mere chance which settings will be used.

    True.  The registry filter facilitates persisting specific registry keys – mainly two registry keys – that involve client/server interaction.  The current architecture is not meant to save system configuration.  So, this functionality is not supported by Microsoft, so it is up to the user to verify whether or not their registry keys would persist.  

    To change system configuration, you need to disable FBWF, make your changes and then enable FBWF.  Please let me know if I’m missing your ask here.

  3. Harry F says:

    I am using it on XPe on embedded industrial computers for robot control. I am wondering:

    when I read a file (it will be in cache) or not (it is still on disk), but i do not modify it, and than I commit (fbwf) it… will there be any write actions on the (flash)disk?

    I use fbwf to reduce writeactions, but I do not always know whether files have been changed. Mostly they are not changed, and not write actions are necessary. I cannot use the atrrib , becuase this does not work in fbwf mode. And I do not wish to keep track of all the modification dates of all files.

    Can anybody advice?

    Best Regards


  4. Abdelkader says:

    Hi Harry,

    In short, a commit operation is going to invoke write operations to the disk (flash), regardless of the changes to the file.  Details below:

    Opening a file does not automatically move it to the cache, as only changed data is cached.

    When there are no changes in the file, there would be very minimal memory consumption.

    However, there will be some write actions to the disk even in the case of no file change, as “commit” for a file will refresh the file system meta data regardless of changes in the file, some directory information will be updated whenever “commit” is issued, including (but not limited to) file change timestamp, directory update logs, etc.  So, the assumption that when there are no changes in the file, the commit functionality does nothing is not 100% technically true.  

    You may have to keep track of changed files if write operations are considered a big concern and you really want to minimize them.

    Please let me know if you have other questions.

  5. Saleem says:

    my problem is that i have industrial PC which run embedded XP as operating system, now i want to insatall a VC6 based application on that computer, when i click the setup file of the application a message appear "NOT A VALID WIN32 APPLICATION". Please help me for the proper installation of the application on the computer.

  6. rhayman says:

    Hi we are using ewf with regitry filters I have coonfigured them as per instructions but cannot get them to work. In the ocmponent dependencies list its says FAT does this mean ntfs isn’t supported

  7. Abdelkader says:

    NTFS is supported.  Can you be more specific about what didn’t work exactly?  Which EWF Mode are you using?  Did you add your partitions in Target Designer?

    If you are using Disk or RAM mode, did you have unpartitioned space for EWF volume?

    Providing more information would help us making better diagnostics of the problem.

  8. Saleem,

    If the OEM who created the embedded image did not include the correct dependenciescomponents in the image then the installation will fail or the app will not run. You need to work with the OEM -they own the image and, as every image is custom, only they know what features they included in it. The OEM may aso not support any changes to the device.


  9. Kalyan Talluri says:

    Hi Friend,

    HW Environment: I want to know the life time of my CFcard. please see the following info & kindly help me.

    HW environment:

    RAM: 1 GB

    Processor: Celeron 1 GHz

    OS: Windows Embedded Standards.

    Silicon Power Compact flash ultra speed size: 8 GBytes

    Endurance: 2000000

    CF Card Speed: 30 M Bytes/sec


    store 100KB every sec coming from industrial devices in SQL Server


    How to get good life time value for the flash?

    What are the factors that will increase/shorten the CF card life ex: Page file, Database etc?

    How to have better performance in WES?

    Please help me.

  10. You might want to post these kinds of questions to the forum instead-


  11. Pinky says:

    I am want to know how to use fbwf without the need of rebooting.Currently the process is disable,reboot,install,enable and finally reboot.

    I want to remove the two rebooting stages in this and save disk in the volume.

  12. Abdelkader says:


    Would you please help me understand your ask – Are you asking about servicing (installing updates) or regular writes to the system?

  13. Pinky says:

    My question is related to insalling updates

  14. Abdelkader says:

    Unfortunately, there is no supported way to eliminate these reboots for servicing.  However, there are some tips and tricks to reduce exposure and down times outlined in this posting http://blogs.msdn.com/embedded/archive/2009/12/29/reduce-exposure-time-and-user-downtime-when-servicing-a-write-filter-enabled-image.aspx.  

  15. kalagan says:

    When it will be implemented EWF in disk mode for Windows 7 (32bit/64Bit)?

  16. Shane says:

    Hi, I am using EWF and HORM. I have a protected System Drive and an un-protected data drive both are NTFS patitions. From time to time I am still having issues with corruption on the data drive. I am not sure what is causing it and it is pretty rare (suspect power down at the wrong time). The problem is once the data partition is corrupted I can't seem to fix it without disabling HORM and EWF. And forcing and using chkntfs d: /c to force a check on next boot.

    If try chkdsk d: /f  (I get error saying type of file system is ntfs. Chkdsk is not available for NTFS drives).

    Is there another way to repair the ntfs partition without disbaling HORM & EWF or should I be using FBWF on the data drive, would this stop potential corruption?

    Also as I side note : Does the Regfilter option work okay with an HORM enabled system?

  17. Gunner says:

    Hi, I would like to know how to successfully install a service when FBWF is enabled. When EWF is enabled, after the service is installed i commit the protected volume and reboot. This way all the files, registry settings and the service application persist. In the case of FBWF, i'm only able to commit the files not the registry settings and the service application. Also, is there any way by which i can add a key in the MonitoredKeys and make it persist while FBWF is enabled? Thanks.

  18. John says:

    How to persist data in the registry in between reboots when FBWF is enabled?

  19. Wolfgang says:

    We re using, FBWF in XPe, installed on a CF-Card. What we really miss is a possibility to notify the user, wehne ver he does changes that will be lost after reboot (say generate a new file in a non-write-through folder).

    Is there any possibility to do this?

    Kind regards,


  20. Abdelkader says:

    Apologies for not answering questions and queries for a while, I’ll try to answer all questions in the order they were asked.

    Kalagan, EWF disk mode is not in our plan of record for WES7.  Please elaborate on your question (scenario) to check for alternative solutions.

    Shane, please refer to the following blog posting for information on how to use HORM with unprotected volumes blogs.msdn.com/…/using-horm-with-unprotected-volumes.aspx.

    Gunner, unfortunately, you cannot commit changes to registry settings with FBWF enabled.  You need disable FBWF in order to add registry keys to the list of monitored keys in Registry Filter.

    John, you can use the registry filter to persist keys (however, this is not supported by Microsoft).  Please refer to the following blog (screen cast) blogs.msdn.com/…/watch-how-to-add-registry-keys-to-regfilter.aspx  that walks you through the whole process of adding a regkey to the registry filter list (adding a key to Runtime image is towards the end).  You can also refer to the following blog for Registry filter tips and tricks blogs.msdn.com/…/registry-filter-tips.aspx. Please note that the write filter has to be disabled to add keys, registry key has to exist before adding it to the list, registry filter supports only keys in the system hive (under HKLM), and registry filter cannot support registry keys used very early in the boot process.  Again, persisting registry keys through the Registry filter is NOT supported by Microsoft, so, it is your responsibility to test and confirm that it works for your scenario.

    Wolfgang, the main purpose of FBWF is to prevent writes to the disk.  It also provides the ability to add exclusion files and folders.  This is the basic concept; so users shouldn’t be changing files outside the exclusion list and expecting them to persist.  Adding such notification, although conceptually sounds good, it would be distracting to users as FBWF cannot differentiate between a file deliberately changed by users and other files changed within the system (e.g. files added/changed in Temporary Internet Files from visiting a website or event logs…etc.).  You can run fbwfmgr.exe /overlaydetail to get the list of all files in the overlay and check if you really need to get notified for each file in this list.

    Please let me know if you ahve other questions or concerns.



  21. zigdong says:

    Hi,we are using ewf in xpe on USB Flash disk(UFD) and the mode is ram enable.After install an application (about 90Mbytes),use "commitanddisable -live"to commit the data to UFD,the commiting is about 300 seconds, in the 300s ,use "diskmon" to monitor the write to UFD ,find that ,the write is about 80s and the cpu usage is low,the other 220s no write operation and the cpu usage is about 50% . is there some config to speed up the commit ,why the cpu usage is so high ?

    the  cpu is p8400@2.26GHZ  duo core. Memory is 2.93GB.

  22. Abdelkader Bahgat says:

    Hi zigdong,

    Would you be able to share 'diskmon' logs with us?  The logs might help us better investigate this issue.