Using the File-Based Write Filter (FBWF) in POSReady

Article
02/19/2009

2/16/2009

You can protect the integrity of your Windows Embedded POSReady 2009 installation by enabling File-Based Write Filter (FBWF). When a user tries to write data to the computer's storage media, FBWF transparently redirects these tries to a RAM cache instead. This RAM cache is called an overlay and can be configured as necessary. FBWF is also useful in scenarios when it is impossible to write to the storage media, such as on a computer that has little free disk space.

Enabling and Managing FBWF

When you enable FBWF, it is automatically configured to have the following settings:

Maximum cache size of 64 MB
Cache type is pre-allocated
Background disk defragmentation is disabled
Low disk warning is disabled
System restore is disabled
Paging file is disabled

The following steps show how to enable and set up FBWF with common settings.

Note

After POSReady is installed, do not immediately enable FBWF. Instead, you should install all desired applications before you enable FBWF. This guarantees that your applications are installed to the storage media instead of the overlay.

How to set up FBWF in POSReady

On the taskbar, choose Start, and then choose Run. The Run dialog box is displayed.
In the Run dialog box, type cmd and choose OK. The command prompt opens.
At the command prompt, type fbwfmgr /enable and press ENTER. This enables FBWF upon restarting your computer.
At the command prompt, type fbwfmgr /addvolume %systemdrive%, where all writes to %systemdrive% will be redirected to the overlay.
Restart your computer. FBWF is now enabled on your specified %systemdrive%. You can apply additional FBWF exclusions by using other command-line options. See the command line syntax in this section for more information.

FBWF Manager Command Line Syntax

Switch	Description
?	Displays usage information and help for using the FBWF manager Example:`fbwfmgr /?`
addexclusion	Adds a write-through path to the exclusion list for next startup The volumename can be either a case-insensitive volume device name (for example, \Device\HarddiskVolume1), or a drive letter (for example, C: or D:). Be aware that the name is not the volume label that Windows Explorer displays before the drive letter. The file or directory path must be an absolute path starting with "\". Example:`fbwfmgr /addexclusion C:\Sample`
addvolume	Adds a volume to the protected volume list for the next startup Example:`fbwfmgr /addvolume C:`
commit	Commits the changes that you made to the file to the underlying media The volumename can be either a case-insensitive volume device name (for example, \Device\HarddiskVolume1), or a drive letter (for example, C: or D:). Be aware that the name is not the volume label that Windows Explorer displays before the drive letter. The file path must be an absolute path starting with "\". Be aware that the volume must currently be protected. Otherwise, the error message "The system cannot find the drive specified." is displayed. Example:`fbwfmgr /commit C:\Sample`
disable	Disables the write filter on the next restart Example:`fbwfmgr /disable`
displayconfig	Displays all configuration information for the write filter including protected volumes list, overlay configuration and write-through paths The command returns: State—Indicating current filter state (enable or disable) and state for the next startup Protected Volumes—List of protected volumes including the current and the next boot state Compression—Current and next boot state for cache compression Threshold—Current and next boot values for the overlay cache threshold Write-Through Paths—Displays a complete list of active and next startup write-through paths Pre-allocation Status—Displays current and next startup status for cache pre-allocation Example:`fbwfmgr /displayconfig`
enable	Enables the write filter on the next restart Example:`fbwfmgr /enable`
getactualsize	Displays the actual volume disk size information Example:`fbwfmgr /getactualsize C:`
getvirtualsize	Displays the virtual volume disk size information Example:`fbwfmgr /getvirtualsize C:`
help / [switch]	Displays help information for a specific FBWF Manager switch Example:`fbwfmgr /help /addvolume`
overlaydetail	Displays details on the current overlay contents for all protected volumes The command returns: Contents—Files and folders currently in the overlay for all protected volumes including sizes (size of data in overlay) and open file handles Memory Usage—Total amount of memory being consumed by the overlay Example:`fbwfmgr /overlaydetail`
removeexclusion	Removes a write-through path from the exclusion list for next startup The volumename can be either a case-insensitive volume device name (for example, \Device\HarddiskVolume1), or a drive letter (for example, C: or D:). Be aware that the name is not the volume label that Windows Explorer displays before the drive letter. The file or directory path must be an absolute path starting with "\". Example:`fbwfmgr /removeexclusion C:\Sample`
removevolume	Removes a volume from the protected volume list for next startup, and either preserves the exclusion list (0) or removes it (1). Example:`fbwfmgr /removevolume C:`
restore	Discards the changes that you made to the file, that is, restores the files to its original contents from the underlying media The volumename can be either a case-insensitive volume device name (for example, "\Device\HarddiskVolume1"), or a drive letter (for example, "C:" or "D:"). Be aware that the name is not the volume label that Windows Explorer displays before the drive letter. The file path must be an absolute path starting with "\". Be aware that the volume must currently be protected. Otherwise, the error message "The system cannot find the drive specified." is displayed. Example:`fbwfmgr /restore C:\Sample`
setcompression	Sets overlay compression as enabled (1) or disabled (0) for the next startup Example:`fbwfmgr /setcompression 0`
setpreallocation	Sets cache pre-allocation as enabled (1) or disabled (0) for the next startup Example:`fbwfmgr /setpreallocation 0`
setsizeddisplay	Sets the size display mode to either virtual (1) or actual (0) The new mode takes effect after the next restart. Example:`fbwfmgr /setsizedisplay 1`
setthreshold	Sets the overlay threshold value for the next startup The input field threshold is the overlay threshold in MB. Example:`fbwfmgr /setthreshold 128`

FBWF and Systems Management Server (SMS) Updates

Systems Management Server (SMS) is a popular way to update and manage Windows Embedded operating systems. If you are deploying FBWF-enabled POSReady computers that will be managed by using SMS, there is important information that you should know.

Installing updates to FBWF-enabled computers requires the following three steps to prevent writing to an overlay instead of the storage media:

Disable FBWF and restart your computer
Download and install the desired updates and restart your computer
Re-enable FBWF and restart your computer

For more information about how to use SMS with a FBWF-enabled computer, see this Microsoft Web site.

FBWF and BOOTSTAT.DAT

The file %windir%\BOOTSTAT.DAT provides support for POSReady features such as the Automatic Recovery Screen that is presented after a failed startup. It cannot be protected by FBWF or POSReady will not shut down correctly. Therefore, BOOTSTAT.DAT is included by default in the FBWF exclusion list.