Qusetion about EWF protect ability

The XPE help document mentioned EWF "protected hard drive while maintaining the appearance of read/write permission to the OS". If there is some virus in RAM which can control the OS files, then it can write to the protected hard drive, right?

Arlin,

Unless you provide a way to commit the changes to the protected partition
(EWF console management app, EWF APIs), a virus will unlikely be able to
store any data (or itself) in the system between OS reboots.

KM

> The XPE help document mentioned EWF "protected hard drive while
maintaining the appearance of read/write permission to the OS". If there is
some virus in RAM which can control the OS files, then it can write to the
protected hard drive, right?

Hi Arlin,

EWF protect partitions so virus can write to overlay but not to physical
disk.
But since EWF is protecting partitions only. Virus still can modify MBR or
physical disk for that mater. (This is only issue with admin and system
accounts)

Regards,
Slobodan

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Have an opinion on the effectiveness of Microsoft Embedded newsgroups? Tell
Microsoft!
https://www.windowsembeddedeval.com...nity/newsgroups
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

"Arlin" <anonymous@discussions.microsoft.com> wrote in message
news:B2888E6D-87FA-4EF8-B3BD-55D936E22C61@microsoft.com...
> The XPE help document mentioned EWF "protected hard drive while
maintaining the appearance of read/write permission to the OS". If there is
some virus in RAM which can control the OS files, then it can write to the
protected hard drive, right?

Slobodan,

Aren't some (if not most) BIOS'es have an option to protect the MBR (or Virus Warning/Protection as they call it)?
But you right, there is always a way to have access to raw partition data bypassing EWF with enough privileges.

--
KM,
BSquare Corporation

> Hi Arlin,
>
> EWF protect partitions so virus can write to overlay but not to physical
> disk.
> But since EWF is protecting partitions only. Virus still can modify MBR or
> physical disk for that mater. (This is only issue with admin and system accounts)
>
> Regards,
> Slobodan
>
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Have an opinion on the effectiveness of Microsoft Embedded newsgroups? Tell
> Microsoft!
> https://www.windowsembeddedeval.com...nity/newsgroups
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> "Arlin" <anonymous@discussions.microsoft.com> wrote in message
> news:B2888E6D-87FA-4EF8-B3BD-55D936E22C61@microsoft.com...
> > The XPE help document mentioned EWF "protected hard drive while
> maintaining the appearance of read/write permission to the OS". If there is
> some virus in RAM which can control the OS files, then it can write to the
> protected hard drive, right?
>
>