I have read about unified write filter. The main working is that overlay is created which write the data on it instead of writing it on volume. Now i am facing a scenario that my overlay size is suppose 1024K and i write 1G data on the protected volume which is more than the overlay size. It gives errors in event log and all the things it should do. On reboot, it vanishes all the written data despite of low size and error messages.

I am wondering about overlay, what is it exactly? (i know its virtual memory).

Does it increase with increasing write data?

What is overlay size? Why is it used and whats its usage other than throwing threshold or exceed errors in event log?

Thanks in advance.


I recommend start reading here: https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/unified-write-filter

The overlay can be in memory or on disk (a hidden file called uwfswap.sys).

It has a predefined size and don't autoadjust or something. If its full, all write requests to the protected volume are blocked, which can lead to apps and also windows hang. Too, a rebbot can take very long time, because windows writes much stuff at shutdown. This can be circumvented by using the Reboot method from UWF itself.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.