A method of protecting memory locations in an embedded system using a write filter. The method includes the steps of starting a write filter that intercepts writes to the protected memory locations and stores the writes in a cache; starting a state machine with a change state and a normal state; upon starting the state machine, entering the change state when an indication is present that data needs to be persisted to the protected memory otherwise entering the normal state; in the normal state identifying critical writes to the protected memory and creating at least one update file containing the changes in such writes; and in the change state, applying the changes in the update file and rebooting the system in a manner that persists the changes to the protected memory.