Wilders Security Forums  

Go Back   Wilders Security Forums > Official Leapfrog Software Forum > FirstDefense-ISR Forum
User Name
Password
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

 
 
Thread Tools Search this Thread
  #1  
Old May 6th, 2006, 11:11 PM
wilbertnl's Avatar
wilbertnl wilbertnl is offline
Very Frequent Poster
 
Join Date: Dec 2004
Location: Tulsa, Oklahoma
Posts: 1,589
Default How do you optimize 'data anchoring'?

Hello All,

I'm in my 14-day trial period for ISR and I need some input.

I've been using Acronis True Image and Farstone Restore-it for a long time. Both solutions are excellent and at the same time have minor disadvantages.
For now that means that I have to change my system concept from disk imaging to snapshots.

So, in order to use disk imaging the easy way, I had a system partition and a data partition, restoring the system partition took a few minutes. (I'm shocked to see how ISR changes to a different snapshot instantly!)

For the 14-day IRS evaluation, I reinstalled windows and removed the data partition: C:\ is the one and only for system and data.

I'm trying to develop a strategy for the data anchors and I found out that the amount of folders/files to anchor is limited.
Which means that I need to create a folder which functions as data container, similar to the previous data partition.
So, I would create a c:\userdata folder which holds %username%\desktop, %username%\my documents, %username%\favorites and %username%\mozilla or %username%\outlook, like I had on the previous data partition.

Do I understand this right? Or do you guys have different strategies?
Also: When data is added or changed in the anchors, this doesn't affect the snapshots themselves? An archive of some snapshot is stored without the anchors? right?

Also, it seems that a snapshot isn't static like a diskimage.
With reloading a diskimage I knew to which status I would revert beforehand. It took actually some time to create a diskimage with all the settings to my liking.
So, I get the understanding that I need to archive a snapshot to approach the same idea of securing a certain status.
I understand that a frozen snapshot means: "do whatever you like until the next reboot", is that correct? (Very nice when I want to test software)

With disk images, I usally had an image of OEM, aka "right after install, with updated drivers and hotfixes", and then another (incremental) image of a complete system with additional installed software. I wished that I was able to create am image tree: OEM with more than one incremental derivate:
OEM - 1. betatest trendmicro internet security
--- - 2. betatest NOD32 antivirus
This seems exactly possible with ISR, right?

Anyway, I'm struggling with the transit of concept from image to snapshot and I appreciate some help in this area.

ISR looks very promissing.
Thank you,
Wilbert
  #2  
Old May 7th, 2006, 02:55 AM
Rilla927's Avatar
Rilla927 Rilla927 is offline
Frequent Poster
 
Join Date: May 2005
Location: Brook Park, OH
Posts: 876
Default Re: How do you optimize 'data anchoring'?

Is this true that Data Anchoring is limited? If so, how limited?

Thanks

Rilla927
__________________
~Rilla927~
  #3  
Old May 7th, 2006, 07:53 AM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 10,537
Default Re: How do you optimize 'data anchoring'?

Quote:
Originally Posted by Rilla927
Is this true that Data Anchoring is limited? If so, how limited?

Thanks

Rilla927

I honestly don't know, but then I've only tried anchoring My Doc's Doing much beyond that would become self defeating.
  #4  
Old May 7th, 2006, 08:46 AM
wilbertnl's Avatar
wilbertnl wilbertnl is offline
Very Frequent Poster
 
Join Date: Dec 2004
Location: Tulsa, Oklahoma
Posts: 1,589
Default Re: How do you optimize 'data anchoring'?

Quote:
Originally Posted by Rilla927
Is this true that Data Anchoring is limited? If so, how limited?

Thanks

Rilla927

"Anchored file list too long":
Attached Images
 

Last edited by ronjor : May 7th, 2006 at 09:44 AM. Reason: Reduce image size
  #5  
Old May 7th, 2006, 09:41 AM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 10,537
Default Re: How do you optimize 'data anchoring'?

Off the top of my head I see stuff I wouldn't recommend anchoring. Like the desktop, and also Local settings application stuff. That is stuff that can be easily messed up and you want it protected by FDISR. I would suggest just anchoring My Documents. That should cover all your data.

The other stuff can be kept current by refreshing the other snapshot(S)

Pete
  #6  
Old May 7th, 2006, 09:43 AM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 10,537
Default Re: How do you optimize 'data anchoring'?

Another factor on Data anchoring is for "Backup" purposes I also keep an archive with no data anchoring. Having a long list would make that a nightmare. Adding and removing my documents is easy

Pete
  #7  
Old May 7th, 2006, 02:17 PM
wilbertnl's Avatar
wilbertnl wilbertnl is offline
Very Frequent Poster
 
Join Date: Dec 2004
Location: Tulsa, Oklahoma
Posts: 1,589
Default Re: How do you optimize 'data anchoring'?

Quote:
Originally Posted by Peter2150
... Like the desktop, and also Local settings application stuff. ...

Yes, the desktop might hold shortcuts that are invalid in some snapshots, but it may also hold complete files. Especially my wife has a habit of storing anything she downloads visible on her desktop.

The local settings path points to the Outlook Express storage.
I rearranged the data that I want to anchor as subfolders of an 'anchor folder', like c:\anchor\%username%\Outlook Express, c:\anchor\%username\my documents.
Pretty much the same as maintaining a separate data partition, would you not agree?
  #8  
Old May 7th, 2006, 02:23 PM
wilbertnl's Avatar
wilbertnl wilbertnl is offline
Very Frequent Poster
 
Join Date: Dec 2004
Location: Tulsa, Oklahoma
Posts: 1,589
Default Re: How do you optimize 'data anchoring'?

Quote:
Originally Posted by Peter2150
... The other stuff can be kept current by refreshing the other snapshot(S) ...
I'm still confused in this area, I don't understand how I can update my current snapshot.
I open the copy/update wizard, select as source the current snapshot, but then I can only select other snapshots or 'create new snapshot'.
I don't see where the update function is?
  #9  
Old May 7th, 2006, 02:48 PM
Acadia's Avatar
Acadia Acadia is offline
Massive Poster
 
Join Date: Sep 2002
Location: SouthCentral PA
Posts: 3,354
Default Re: How do you optimize 'data anchoring'?

How could you, and why would you want to update your current Snapshot; it is always up-to-date.

Acadia
__________________
The blazing evidence of immortality is our dissatisfaction with any other solution. -- Emerson

Last edited by Acadia : May 7th, 2006 at 03:02 PM.
  #10  
Old May 7th, 2006, 02:57 PM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 10,537
Default Re: How do you optimize 'data anchoring'?

Quote:
Originally Posted by wilbertnl
I'm still confused in this area, I don't understand how I can update my current snapshot.
I open the copy/update wizard, select as source the current snapshot, but then I can only select other snapshots or 'create new snapshot'.
I don't see where the update function is?

Hi Wilbertnl

At this point the best recommendation is to read, reread, and reread again, the help documentation. This is essential for this program.

Pete
  #11  
Old May 7th, 2006, 03:05 PM
Acadia's Avatar
Acadia Acadia is offline
Massive Poster
 
Join Date: Sep 2002
Location: SouthCentral PA
Posts: 3,354
Default Re: How do you optimize 'data anchoring'?

I would do as Peter recommended; I had to read all three, the User Guide, the FAQs, and the Knowledgebase, each several times before I began to understand this program. It is only complicated because it is so flexible.

Acadia
__________________
The blazing evidence of immortality is our dissatisfaction with any other solution. -- Emerson
  #12  
Old May 7th, 2006, 03:15 PM
crofttk's Avatar
crofttk crofttk is offline
Very Frequent Poster
 
Join Date: May 2004
Location: Eastern PA, USA
Posts: 1,693
Default Re: How do you optimize 'data anchoring'?

Yep, you current snapshot is THE ONE YOU'RE OPERATING FROM, and you are "updating" it by writing changes to your hard drive.

Now, you CAN, update your "secondary" snapshot whenever you feel the need or on a schedule. "Secondary" snapshot here is simply a point in time copy of your primary (or "operating") snapshot.

Also, regarding anchoring any of the stuff besides your "My Documents" structure, like desktop, local settings, application data, etc., remeMber that alot of these files are linked to your installed programs and the registry (even contains some of the registry !) and you could have big problems reverting to a snapshot for which these folders and their data is not in synch with the instaqll programs and entire registry of that particular snapshot. Itwould be a risky and complex strategy, IMO (humble or not, don't matter -- it's my opinion good or bad ).

Plus, consider that if you start developing separate snapshots for sandboxing or experimenting with new/beta programs you don't want to affect your baseline system, you have to think carefully through the usefulness, or NOT, of data anchoring in that situation -- I'm sure Peter2150 can tell you plenty about that.

And, YES, read the documentation, take a break, and then keep coming back and reading it again until it sinks in -- that's what it took for me.
__________________
"Ignorance more frequently begets confidence than does knowledge..." - Charles Darwin -
  #13  
Old May 7th, 2006, 04:17 PM
wilbertnl's Avatar
wilbertnl wilbertnl is offline
Very Frequent Poster
 
Join Date: Dec 2004
Location: Tulsa, Oklahoma
Posts: 1,589
Default Re: How do you optimize 'data anchoring'?

Well, I have been reading the manual and FAQ's, but sometimes I miss an example to clarify the information.

I do appreciate the concerns about my choice of anchored data, but to me this is the same choice I made when I used disk imaging of the system partition. I'm aware of possible flaws, but it works for me. I make sure that I only anchor data, and not settings.

Crofttk:
You say that I update my current snapshot when I make changes to my system. But when I boot from the snapshot, it all reverts to the original status of when the snapshot whas created, right?

With diskimaging I made changes and was able to update any selected image.
[for example load OEM image, update drivers, save OEM image]
It seems to work different with ISR.
  #14  
Old May 7th, 2006, 04:32 PM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 10,537
Default Re: How do you optimize 'data anchoring'?

Quote:
Originally Posted by wilbertnl

Crofttk:
You say that I update my current snapshot when I make changes to my system. But when I boot from the snapshot, it all reverts to the original status of when the snapshot whas created, right?

W

No. Assuming you aren't messing with Freezing, and I wouldn't recommend that at first, when you leave a snapshot, it remains as you left it. The snapshot you are working in is just like your system without FDISR. You came back and it is like when you left it. Only when you do a copy from one to another is one changed. Note if you are comparing to Rollback, they are totally different.

Pete
  #15  
Old May 7th, 2006, 04:52 PM
Acadia's Avatar
Acadia Acadia is offline
Massive Poster
 
Join Date: Sep 2002
Location: SouthCentral PA
Posts: 3,354
Default Re: How do you optimize 'data anchoring'?

Quote:
Originally Posted by Peter2150
Note if you are comparing to Rollback, they are totally different.
Good point, they operate in totally different ways. There is NEVER any need to update the Snapshot that you are in; if you leave it to go to another Snapshot, then come back to it, you will find it exactly as you left it.

Acadia
__________________
The blazing evidence of immortality is our dissatisfaction with any other solution. -- Emerson
  #16  
Old May 7th, 2006, 05:29 PM
Leapfrog Software Leapfrog Software is offline
Leapfrog Moderator
 
Join Date: Jan 2006
Location: Northern Nevada, USA
Posts: 209
Default Re: How do you optimize 'data anchoring'?

Greetings All,

Ok, let me put in my 2 cents, this time as only a user of the ISR technology.

I personally Data Anchor "My Documents" and "Favorites". Lots of folks also add "Desktop" as well, but I like to keep all documents, projects, etc. in a common folder like "My Documents". I even redirect Outlook and Outlook Express+address book to a sub-folder in “My Documents”. If I need to backup my data or transfer it to another system, it just makes it easier to drag and drop one or two folders. As the years pass and CRS (Can't Remember *Stuff*) sets in, one can benefit from all the organization one can get!

I have found the more folks Data Anchor, the more they forget what they have anchored over the long run, and/or boot to a snapshot that had something Data Anchored deep in Local Settings, Application Data, etc. that *Bill G* did not want one to mess with, and now holds the possibility of being out of sync with the registry or another application.

Now, from a LSI perspective, the number of Data Anchored folder is limited because of the above reason as well. During our intensive and initial beta testing, folks found all sorts of ways to Data Anchoring and make our task of troubleshooting, shall we say, interesting.

I hope this helps. If you need more information on a few best practices of Data Anchoring, check out this application note.
__________________
- Todd

Last edited by Leapfrog Software : May 7th, 2006 at 06:13 PM.
  #17  
Old May 7th, 2006, 07:13 PM
wilbertnl's Avatar
wilbertnl wilbertnl is offline
Very Frequent Poster
 
Join Date: Dec 2004
Location: Tulsa, Oklahoma
Posts: 1,589
Default Re: How do you optimize 'data anchoring'?

Quote:
Originally Posted by Leapfrog Software
... I have found the more folks Data Anchor, the more they forget what they have anchored over the long run, and/or boot to a snapshot that had something Data Anchored deep in Local Settings, Application Data, etc. that *Bill G* did not want one to mess with, and now holds the possibility of being out of sync with the registry or another application ...
With documents and data I'm compulsively organized. [team workers praise me for that].
With disk imaging I had my stuff on a data partition, and I got the feeling that data anchoring would eliminate the need to create a container for important data.

I see your point that you don't want to anchor stuff in hidden folders with names that start with '{' and end with '}'. But fact is that to prepare my data for anchoring, I still find myself editing registry entries to change pointers on the disk. For each and every user on my computer.

Hmm...

I would rather see it like this: "Anchor 'c:\documents and settings' except for registry files and other settings data"
  #18  
Old May 7th, 2006, 07:47 PM
TonyW TonyW is offline
Very Frequent Poster
 
Join Date: Oct 2005
Location: UK
Posts: 1,432
Default Re: How do you optimize 'data anchoring'?

I anchor 'My Documents' and the OE email storage.
  #19  
Old May 7th, 2006, 08:07 PM
Acadia's Avatar
Acadia Acadia is offline
Massive Poster
 
Join Date: Sep 2002
Location: SouthCentral PA
Posts: 3,354
Default Re: How do you optimize 'data anchoring'?

Has anyone ever given any thought as to how easy it might be for a computer virus to spread to other Snapshots if the virus contaminates something that is Anchored? This is the only reason that I do not use the Data Anchor feature. Is this a reasonable fear or not?

Acadia
__________________
The blazing evidence of immortality is our dissatisfaction with any other solution. -- Emerson
  #20  
Old May 7th, 2006, 08:51 PM
wilbertnl's Avatar
wilbertnl wilbertnl is offline
Very Frequent Poster
 
Join Date: Dec 2004
Location: Tulsa, Oklahoma
Posts: 1,589
Default Re: How do you optimize 'data anchoring'?

Quote:
Originally Posted by Acadia
... This is the only reason that I do not use the Data Anchor feature ...

What you say
You don't use the most powerful feature of this software?

No, I think this is very close to mysophobia.
You copy updated address books and other documents to each snapshot, then?
Or do you have a secret second partition, which in effect has the same potential of hazard.
  #21  
Old May 8th, 2006, 12:04 AM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 10,537
Default Re: How do you optimize 'data anchoring'?

Quote:
Originally Posted by Acadia
Has anyone ever given any thought as to how easy it might be for a computer virus to spread to other Snapshots if the virus contaminates something that is Anchored? This is the only reason that I do not use the Data Anchor feature. Is this a reasonable fear or not?

Acadia

Hi Acadia

Depends on what you Anchor. I doubt many virii attack what is in my doc's

Pete
  #22  
Old May 8th, 2006, 08:08 AM
Acadia's Avatar
Acadia Acadia is offline
Massive Poster
 
Join Date: Sep 2002
Location: SouthCentral PA
Posts: 3,354
Default Re: How do you optimize 'data anchoring'?

Peter, I'm mostly thinking email. I've only ever contracted three viruses in my 7 years of computing, and all three of them came thru the email. Also, using MacroExpress I've created macros that enable me to quickly copy files (My Docs, Email, Favs) from a Snapshot over to my other hard drive in case I want to put those files into another Snapshot. I just have this thing of wanting to keep my Snapshots COMPLETELY separated from one another, no "connection" between them.

Acadia
__________________
The blazing evidence of immortality is our dissatisfaction with any other solution. -- Emerson

Last edited by Acadia : May 8th, 2006 at 08:34 AM.
  #23  
Old May 8th, 2006, 08:52 AM
wilbertnl's Avatar
wilbertnl wilbertnl is offline
Very Frequent Poster
 
Join Date: Dec 2004
Location: Tulsa, Oklahoma
Posts: 1,589
Default Re: How do you optimize 'data anchoring'?

Acadia,

I can see how you don't need your Office documents when you are in your gaming snapshot.

But when I beta-test antivirus software then I need this software in a separate snapshot and at the same time I need to be be able to use my computer without data limitations.
In my lifetime of computer experience I have been infected only once, and a couple virii have been caught in time.

When your concern is getting infected through e-mail, would it help you if you don't use a local email client anymore, but only webmail?
I'm using an IMAP mailserver, which means that the mail is never downloaded to my computer, until I open it. And as long as I'm able to connect to the IMAP server, I'm able to read my e-mail wherever I am.
  #24  
Old May 8th, 2006, 09:04 AM
Acadia's Avatar
Acadia Acadia is offline
Massive Poster
 
Join Date: Sep 2002
Location: SouthCentral PA
Posts: 3,354
Default Re: How do you optimize 'data anchoring'?

I don't do any gaming.

Webmail is NOT an acceptable solution, I do not want my important email with sensitive information stored on someone else's server; I only use webmail for unimportant stuff and as spam traps.

Acadia
__________________
The blazing evidence of immortality is our dissatisfaction with any other solution. -- Emerson
  #25  
Old May 8th, 2006, 01:03 PM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 10,537
Default Re: How do you optimize 'data anchoring'?

Hi Acadia

You make a point, but I've nailed that coffin pretty tightly with other security software. For example zip files are tightly controlled in that 1) only explorer is allowed to start winzip, so for example Outlook which can conceiveably start winzip can't without specific permission. Also anything run automatically from with in winzip has to be started by winzip. I have it set so it has to ask before it can do that. Also KAV 6.0's PDM module monitors office macro's for behavior so anything in a doc file that's bad gets flagged. Plus I do a full AV scan of my system every night. Only takes a few minutes.

Agreed if I wasn't doing all this I might go the same way you are.

Pete
 

Wilders Security Forums > Official Leapfrog Software Forum > FirstDefense-ISR Forum « Previous Thread | Next Thread »

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Settings
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -5. The time now is 05:54 AM.


Powered by vBulletin® Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Copyright ©2002 - 2009, Wilders Security Forums