Paul,
See:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xpehelp/htm
l/xetskEWFManagerUsage.asp
EWF can be either "enabled" or "disabled". In "disabled" mode, any changes
made to the protected volume are actually written to the volume. In other
words, the volume is NOT protected - or protection is "disabled".
In "enabled" mode, the changes to the protected volume are written to the
EWF overlay area (either RAM or DISK based).
You can only change modes via a reboot. You use ewfmgr.exe to set the mode.
You can run ewmgr to see if it is currently enabled or disabled:
ewfmgr c:
will report either:
Protected Volume Configuration
Type RAM
State ENABLED
or
Protected Volume Configuration
Type RAM
State DISABLED
You can then change the mode (but it will not take affect until you reboot)
by using either:
ewfmgr c: -enable
or
ewfmgr c: -disable
If you ewf is currently enabled, you can use:
ewfmgr c: -commit
to actually commit all the changes
If using DISK based EWF and you want to lose all changes on the overlay on a
reboot, use:
ewfmgr c: -restore
When using RAM overlays, you will lose changes on reboot anyway.
Scott