what if overlay exceeds limit in Unified Write Filter(UWF)

Question

I have read about unified write filter. The main working is that overlay is created which write the data on it instead of writing it on volume. Now i am facing a scenario that my overlay size is suppose 1024K and i write 1G data on the protected volume which is more than the overlay size. It gives errors in event log and all the things it should do. On reboot, it vanishes all the written data despite of low size and error messages.

I am wondering about overlay, what is it exactly? (i know its virtual memory).

Does it increase with increasing write data?

What is overlay size? Why is it used and whats its usage other than throwing threshold or exceed errors in event log?

Thanks in advance.

Answer 1

I recommend start reading here: https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/unified-write-filter

The overlay can be in memory or on disk (a hidden file called uwfswap.sys).

It has a predefined size and don't autoadjust or something. If its full, all write requests to the protected volume are blocked, which can lead to apps and also windows hang. Too, a rebbot can take very long time, because windows writes much stuff at shutdown. This can be circumvented by using the Reboot method from UWF itself.