Enhanced Write Filter

All you want to know about Enhanced Write Filter

This article or section is missing information about: the writer's general incertitude on the subject needs to be addressed..
This concern has been noted on the talk page where it may be discussed whether or not to include such information. (May 2008)

The tone or style of this article or section may not be appropriate for Wikipedia.
Specific concerns may be found on the talk page. See Wikipedia's guide to writing better articles for suggestions. (June 2008)

Enhanced Write Filter (or EWF) is a component of Windows XP Embedded that basically sits between the software and hardware and listens for any writes to a volume, and filters them to another medium instead of being physically written to the volume itself.^[1] You can choose (through either action or inaction) to commit the writes to the physical volume later. One of its (primary) operating modes is called "RAM (REG)", which means that writes are stored in memory, and the settings are stored in the system registry. So, if you write a file (say, by downloading it), EWF begins to consume memory needed to "write" the file (it's not written to the drive, though it appears to be there). If you erase that file, memory may or may not be freed (not sure how EWF handles that), but if the file is rewritten, more memory doesn't need to be claimed because it reuses the original memory. You can even defragment a drive with EWF enabled, committing the changes (and then rebooting) as you go.

Since EWF is a component of Windows XP Embedded, which in turn is a broken-up implementation of Windows XP Professional, EWF can be installed on a computer running an off-the-shelf version of Windows XP as well^[2].

ewfmgr is the command dedicated to the EWF component.