January 2003 MSDN

*Article
Stephen Berard/Microsoft Corporation

EWF provides a means for protecting a volume from writes. This allows the operating system (OS) to boot from read-only media such as CD-ROMs, write-protected hard disks, or flash media. All writes to an EWF-protected volume are redirected to an overlay. These writes are cached in the overlay and made available as part of the volume. This gives the appearance that the volume is writeable. The overlay may exist either on disk or in random access memory (RAM). If desired, the data stored in the overlay may be committed to the protected volume.

For more information...