Enhanced write filter

  • Thread starter Thread starter De Pessemier An
  • Start date Start date
D

De Pessemier An

Hi,

I tried "Enhanced write filter" for my device.
The system is based on Disk overlay.
I've i want to restore my system to a previous level, i can.
But what do i have to do if someone deletes the drivers folder (example)?
The system won't start anymore so i can't restore it to the previous level?
Does someone have a solution for this problem?

Thanks,
An
 
If I understood you question correctly, you should not bother if someone
deletes any system folder unless he/she commits the changes to the disk.
If your concern is end user, you may restrict access to the system files for
particular user accounts (group) and, also, remove ewfmgr from your system.
 
If you hit F8 as the BIOS completes its POST (power on self test), you will
come to a startup screen. You may need to hit F8 a 2nd time to get to the
"Windows Advanced Options Menu." From there you can select "Enhanced Write
Filter Restore Mode (restores one level)". This will do the same thing as
running ewfmgr /restore, but it occurs very early in boot (EWF-NTLDR
supplies this feature), even before the damaged overlay (that contains
missing Windows or System32 items) is active.
 
Back
Top