About This File
File Based Write Filter (FBWF) Add for Windows XP
File-Based Write Filter (FBWF) enables you to protect volumes from write operations. FBWF intercepts writes and redirects them to a different storage location called an overlay which enables stateless operation, or creating a protected OS image. By protecting volumes from writes, FBWF also reduces the wear of flash media. By default, FBWF uses only RAM overlay, which discards all changes on reboot. You can also use the Selective Commit option, which lets you specify the files or file changes that you want to commit to disk. With the Selective Commit option, you can preserve the changes you choose between reboots and then discard the rest. You can also use FBWF to perform dynamic protection, add and remove volumes at runtime, and to preserve and reclaim memory in the overlay.
One feature of FBWF is intelligent filtering, which lets you specify files and folders to be persisted, while protecting the rest of the volume. Therefore, you can persist changes to a file, such as the antivirus signature file, or to a directory, such as the user’s Documents and Settings folder within the protected volume. The list of files and folders to persist is called a write through or exclusion list. On the other hand, FBWF lacks support for File System specific features such as NTFS file encryption, hard link, and quota. Additionally, FBWF's commit functionality is considered limited as it commits only individual files, not allowing the commit of entire directory content, or new directories, or deleted files.
You can use the command prompt utility FBWF Manager (Fbwfmgr.exe) to perform run-time configuration tasks such as enabling or disabling the filter; adding or removing volumes; adding or removing files and folders to the exclusion list; committing or restoring files; setting and updating the configuration; and more. Fbwfmgr.exe also reports configuration and usage status.
You can use either of the two write filters: the Enhanced Write Filter (EWF) or the FBWF. FBWF is usually a better choice because FBWF operates at the file level while EWF operates at the sector level. FBWF Manager provides many options and configuration tasks that do not exist in EWF Manager, such as changing allocation mode and adding volumes. For more information see FBWF and EWF.