FBWF 全称File-Based Write Filter 他为操作操作系统提供文件及目录写保护功能兼磁盘保护功能，并且对在只读介质上运行微软操作操作系统的写入成为可能.
以上为本人个人理解可能与他本身功能或者是多或者是少有所出入，经过阅读EMBEDDED 2007的帮助文档，感觉他比EWF的功能有过之而不能是无不及！他可以通过系统命令灵活的添加要保护的卷，目录及文件.特别是目录功能以及文件过滤功能是EWF所不能做到的！希望对此有研究的朋友也来参与讨论！因条件限制，没有再去安装开发环境重新做一个带有FBWF的操作操作系统，提取到的一些个人感觉有用的文件，如果哪位有补充请跟贴！＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
贴一些微软的资料：The FBWF Manager is a command line tool for embedded developers to quickly integrate and prototype the FBWF. FBWF Manager is intended primarily for design time use.The FBWF Manager command line syntax follows:fbwfmgr [/? | /help /[switch] | /displayconfig | /overlaydetail | /enable | /disable | /addvolume [volumename] | /removevolume [volumename] [1|0] |
/addexclusion [path] | /removeexclusion [path] |
/setthreshold [threshold] | /setcompression [1|0] | /setpreallocation [1|0] ]
The following table describes the command line switches.Switch Description
displayconfig Displays all configuration information for the write filter including protected volumes list, overlay configuration and write through paths. The command returns:
State—Indicating current filter state (enable or disable) and state for next boot.Protected Volumes—List of protected volumes including the current and next boot state.Compression—Current and next boot state for cache compression.Threshold—Current and next boot values for the overlay cache threshold.Write Through Paths—Displays a complete list of active and next boot write through paths.Pre-allocation Status—Displays current and next boot status for cache pre-allocation.
overlaydetail Displays detail on the current overlay contents for all protected volumes. The command returns:
Contents—Files and folders currently in the overlay for all protected volumes including sizes (size of data in overlay) and open file handles.Memory Usage—Total amount of memory being consumed by the overlay.
enable Enables the write filter on the next restart.
disable Disables the write filter on the next restart.
addvolume Adds a volume to the protected volume list for next boot.
removevolume Removes a volume from the protected volume list for next boot.
addexclusion Adds a write through path to the exclusion list for next boot.
removeexclusion Removes a write through path from the exclusion list for next boot.
setthreshold Sets the overlay threshold value for next boot.
setcompression Sets overlay compression as enabled I. or disabled (0) for next boot.
setpreallocation Sets cache pre-allocation as enabled I. or disabled (0) for next boot.
commitfile Commits a specified file.
restorefile Restores a specified file.
? Displays usage and help.
help / [switch] Displays help information for a specific FBWF Manager switch.
[ By the end of this article 天风 于 2006-11-24 11:27 PM Editor ]-------
找时间试验一下，或者是可以用来替代ewf这一个有没有32m的限制？-------
只比
strongchen
上次上传给我们的多了两个文件-------
FBWF默认CACHE计算机内存大小是64M，如果在EMBEDDED开发环境中是可以指定的！但现在我手上没有成品操作操作系统！-------
Personally thinking should be the affair of the same.-------
CACHE计算机内存大小是否和这有关系？
0x4,"ControlSet001\Services\FBWF","WinPECacheThreshold",0x20
当中 0x20 为 32M
0x10 - 16М
0x18 - 24М
0x20 - 32М
0x30 - 48М
0x40 - 64М
0x48 - 72М
0x60 - 96М
0x80 -128М
0x100 - 256М-------
好不容易休息二天都贡献给这一个FBWF了！基本上告以成功！暂时没有发现楼上所说的注册表(Regedit)项！目前用提取的文件植入XP SP2中运行正常，比EWF好用！不做其他设置到目前为止没有出现延缓写入失败的情况！利用/DISPLAYCONFIG参数查看状态，CACHE大小占用16M没有找到在哪个键值来更改大小！-------
补充fbwf的二个参数：ControlSet001\Services\FBWF","WinPECacheThreshold",0x00000050这一个是光盘最大的可些size，不设置的时候是32M.（在10进制下33代表32M）如果要调整光盘的可写空间设置这里就可以啦（启动操作系统后计算机内存并不怎么会占用，而不能是是用多少算多少）ControlSet001\Services\FBWF","CacheType", 0x1; "Apparently" you can either Pre-Allocate the cache to full size,
; say 64Mb and it starts off at 64Mb, or you can set it to grow
; dynamically, where it dynamically increases. You can also try
; the dynamically compressed setting, but this may come with a
; performance hit, meaning file access will be slower, but this
; setting is better for lower RAM systems.1 的时候是动态分配计算机内存
2 的时候是动态分配计算机内存加计算机内存压缩（计算机内存比较小就有用了）
3 的时候是马上占用所有fbwf需要的计算机内存（基本不考虑用了）以上内容我都测试过...
[ By the end of this article strongchen 于 2006-11-26 09:39 PM Editor ]-------
下面是我在XP中用的内容！＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FBWF]
"Start"=dword:00000000
"Type"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hexII.:73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,\
72,00,69,00,76,00,65,00,72,00,73,00,5c,00,46,00,62,00,77,00,66,00,2e,00,73,\
00,79,00,73,00,00,00
"Group"="FSFilter System Recovery"
"DisplayName"="File-Based Write Filter"
"Description"="File-Based Write Filter driver"
"DependOnService"=hexVII.:46,00,6c,00,74,00,4d,00,67,00,72,00,00,00,00,00
"DebugFlags"=dword:00000000
"EnabledOnAllSkus"=dword:00000001-------
怎么设置保护那些路径？期待天风完整的xp安装文件 ^_^
坚决不回答能够在论坛找的到答案的基本问题.
