I'm a program Manager with the Windows Embedded Standard team working on the write filters – Enhanced Write Filter (EWF), File Based Write Filter (FBWF), and Registry Filter. I have been with Microsoft for almost 9 years, but just joined the Embedded team last year to work on the next version of Embedded systems based on Windows 7 codename 'Quebec'.
Write filters are part of the Embedded Enabling Features (EEFs) that enable the Embedded Windows community to protect their disks. They bring a wide variety of benefits including system resilience and reliability, stateless device operation, fast reboot capabilities with Hibernate Once Resume Many (HORM), and reducing wear on flash devices. The Disk protection in Windows Embedded Standard more than just a useful feature blog provides an overview of the write filters and corresponding benefits. Additionally, the write filters provide configuration and management utilities both at image creation and runtime. The Managing Disk Protection blog provides an overview for both configuration and runtime management. On the other hand, the great benefits of these features sometimes come at a cost, as they may interfere with the functionality of some other feature in the system especially those that require persistent write to the disk; servicing is a classical example as you currently cannot service a system that is protected by a write filter, unless you turn off the filter before servicing then turn it on again after you are done.
That said, we want to hear back from you about your experience, scenarios, pain points, and suggestions for the write filters. Your feedback is essential to direct our design more towards your scenarios and adapt our development to fulfill your requirements. Although I can't commit to accommodating all suggestions, issues and/or problems in our upcoming release, I'll make sure that this feedback becomes part of our core requirements and design considerations for subsequent releases.
Thank you for reading my first posting and I’m looking forward to having useful postings and productive discussions on this blog.
I'm using FBWF to protect flash devices.
For me there are some important parts still missing:
- a service to control the overlay. It should do some configurable tasks on low memory. e.g. reboot
- a service or change of the interface to allow non admins to commit some files (e.g. via context menu in Explorer)
- the possibility to commit all changes in the overlay to disk and free all memory
Registry Filter is nearly useless, because it starts to late. Try to add TCP/IP settings to the RegFilter.
It's mere chance which settings will be used.
Thank you for providing this valuable feedback. I wanted to get some clarification on a couple of points from your comments. Thanks.
Would an interface (API) be enough for this purpose? This way we are giving OEMs the flexibility to create their own applications according to their actual need.
OR are you looking for a runtime app/service? If so, how would you like it to operate e.g. notify user, reboot…etc? Should it be configurable at runtime or just during image creation?
Would you please elaborate on this scenario? I would be more in favor of using the exclusion list than allowing non-administrators to commit files in different parts of an FBWF protected system. This way we can limit non-admins access to only pre-specified set of files/directories (which are within their exclusion list).
- Registry Filter is nearly useless, because it starts to late. Try to add TCP/IP settings to the RegFilter.
True. The registry filter facilitates persisting specific registry keys – mainly two registry keys – that involve client/server interaction. The current architecture is not meant to save system configuration. So, this functionality is not supported by Microsoft, so it is up to the user to verify whether or not their registry keys would persist.
To change system configuration, you need to disable FBWF, make your changes and then enable FBWF. Please let me know if I’m missing your ask here.
I am using it on XPe on embedded industrial computers for robot control. I am wondering:
when I read a file (it will be in cache) or not (it is still on disk), but i do not modify it, and than I commit (fbwf) it... will there be any write actions on the (flash)disk?
I use fbwf to reduce writeactions, but I do not always know whether files have been changed. Mostly they are not changed, and not write actions are necessary. I cannot use the atrrib , becuase this does not work in fbwf mode. And I do not wish to keep track of all the modification dates of all files.
Can anybody advice?
In short, a commit operation is going to invoke write operations to the disk (flash), regardless of the changes to the file. Details below:
Opening a file does not automatically move it to the cache, as only changed data is cached.
When there are no changes in the file, there would be very minimal memory consumption.
However, there will be some write actions to the disk even in the case of no file change, as “commit” for a file will refresh the file system meta data regardless of changes in the file, some directory information will be updated whenever “commit” is issued, including (but not limited to) file change timestamp, directory update logs, etc. So, the assumption that when there are no changes in the file, the commit functionality does nothing is not 100% technically true.
You may have to keep track of changed files if write operations are considered a big concern and you really want to minimize them.
Please let me know if you have other questions.
my problem is that i have industrial PC which run embedded XP as operating system, now i want to insatall a VC6 based application on that computer, when i click the setup file of the application a message appear "NOT A VALID WIN32 APPLICATION". Please help me for the proper installation of the application on the computer.
Hi we are using ewf with regitry filters I have coonfigured them as per instructions but cannot get them to work. In the ocmponent dependencies list its says FAT does this mean ntfs isn't supported
NTFS is supported. Can you be more specific about what didn't work exactly? Which EWF Mode are you using? Did you add your partitions in Target Designer?
If you are using Disk or RAM mode, did you have unpartitioned space for EWF volume?
Providing more information would help us making better diagnostics of the problem.
If the OEM who created the embedded image did not include the correct dependencies\components in the image then the installation will fail or the app will not run. You need to work with the OEM -they own the image and, as every image is custom, only they know what features they included in it. The OEM may aso not support any changes to the device.
HW Environment: I want to know the life time of my CFcard. please see the following info & kindly help me.
RAM: 1 GB
Processor: Celeron 1 GHz
OS: Windows Embedded Standards.
Silicon Power Compact flash ultra speed size: 8 GBytes
CF Card Speed: 30 M Bytes/sec
store 100KB every sec coming from industrial devices in SQL Server
How to get good life time value for the flash?
What are the factors that will increase/shorten the CF card life ex: Page file, Database etc?
How to have better performance in WES?
Please help me.
You might want to post these kinds of questions to the forum instead-
I am want to know how to use fbwf without the need of rebooting.Currently the process is disable,reboot,install,enable and finally reboot.
I want to remove the two rebooting stages in this and save disk in the volume.
Would you please help me understand your ask - Are you asking about servicing (installing updates) or regular writes to the system?
My question is related to insalling updates
Unfortunately, there is no supported way to eliminate these reboots for servicing. However, there are some tips and tricks to reduce exposure and down times outlined in this posting http://blogs.msdn.com/embedded/archive/2009/12/29/reduce-exposure-time-and-user-downtime-when-servicing-a-write-filter-enabled-image.aspx.
When it will be implemented EWF in disk mode for Windows 7 (32bit/64Bit)?