Wilders Security Forums  

Go Back   Wilders Security Forums > Software, Hardware and General Services > sandboxing & virtualization
User Name
Password
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

 
 
Thread Tools Search this Thread
  #1  
Old September 25th, 2007, 09:27 AM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default ShadowDefender & FirstDefense-ISR

I installed ShadowDefender (SD) in my off-line snapshot without any problems to solve two problems :

1. FDISR has a few shortcomings :
a. You can have only ONE frozen snapshot in FDISR.
This means, I don't have an automated cleaning for my off-line snapshot, because my on-line snapshot is already frozen.

b. FDISR's worst part are schedules and has only time-schedules and no demand schedules, like ShadowProtect.
This means, I don't even have a half-automated cleaning for my off-line snapshot.

So I have to do this manually. In other words I have to "work" and that is against my principles, because my computer has to "work" for me, not the other way.
I do the brain work and my computer does the routine jobs as a digital slave.

2. My theoretical assumption is that each software, installed on my off-line snapshot, creates temporary objects (files + registries) to do something, but they don't remove these objects always after the job is done.
The problem is that I don't always know, WHERE these temporary objects are stored and when I don't know, I cannot verify, if they are removed or not.
The number of these objects increases every day and that becomes a serious problem sooner or later.

For instance, my video-editing software creates at least two folders, that grow with minimum 4gb per editing job. After the job is completed, I don't need the contents of these two folders anymore, because the final output-file is stored on my DATA partition, but these folders are not emptied by the video-editing software itself.

Of course I noticed this garbage immediately, because 4gb is alot, but what about the other softwares ? They create also garbage, that grows and grows.
DVDShrink remembers each analyzed movie and I don't even know where it gets that information. Is it stored in a file or registry ? I don't know.

That's the reason, why I need SD, because I don't like to know where the garbage of each individual software is stored, because I don't want to know, I just want to get rid of it.

So I installed SD in my off-line snapshot and did a video-editing job, which I've done more than 150 times already, because I wanted to know two things :

1. Can I still do this job like I always did.
2. Are the two work folders, used by this software, EMPTY or not, AFTER the job.

So, I activated ShadowMode in partition [C:] only and moved the "ShadowMode"-label, right above the system clock. SD remembers the position of the "ShadowMode"-label, even after reboot and the next "ShadowMode"-session and that's GOOD.

Then I did the video-editing job like always and the final result was identical.
I checked the two folders, while I was doing the job and both were full of garbage.

Then I rebooted my computer with ShadowMode = ON and both folders were empty.
I also tried the "Exit ShadowMode"-button, which requires a reboot and both folders were again empty.
Keep in mind that this counts for any garbage-creating software, even when you don't know where the garbage is stored and that is for me an excellent solution without doing anything than reboot.
No registry cleaning, no garbage cleaning, no need of refreshing with FDISR-archive anymore.

I assume that Returnil can do the same job, but this thread is about ShadowDefender.

The next step : installing SD on my on-line snapshot, which is much bigger job for SD of course. SD has to replace my Freeze Storage.arx, so that I don't need a frozen snapshot anymore.

So far, I'm satisfied with SD. It's a very simple and logical software, BUT the story isn't finished yet.
After all, this is my first contact with SD and I have to start simple.

So my off-line snapshot is significantly improved :
- it will always be clean with the same good working objects, that never change.
- it will always have the same snapshot size
- it will always have the same backup time/size and archive time/size.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.

Last edited by ErikAlbert : September 25th, 2007 at 09:47 AM.
  #2  
Old September 25th, 2007, 11:09 AM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 11,808
Default Re: ShadowDefender & FirstDefense-ISR

Hi Erik

Couple of points.

First as you noticed even rebooting and staying in Shadow Mode what you'd done was cleaned out.

Second, which version did you install. Several of us are noticing issues with 95, that don't seem to be there with 91. I am repeating a stress I did on 95 today on 91. If only have 95 pm me an email address and I will send 91 to you.

Pete
  #3  
Old September 25th, 2007, 12:13 PM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default Re: ShadowDefender & FirstDefense-ISR

Quote:
Originally Posted by Peter2150
First as you noticed even rebooting and staying in Shadow Mode what you'd done was cleaned out.
That's the purpose of reboot, cleaning it out.
If I reboot in a frozen snapshot, it would be cleaned out as well.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
  #4  
Old September 25th, 2007, 01:19 PM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default Re: ShadowDefender & FirstDefense-ISR

If ShadowMode = ON in both snapshots, you can't use the function "Boot to snapshot" of FDISR anymore. FDISR keeps on rebooting in the current snapshot, instead of the other snapshot.
The only way to solve this, is using the F1-key, but that doesn't solve the problem entirely.
If you do this, the other snapshot has still the "ShadowMode"-label, but the protection is gone according the System Status, partition [C:] has no blue color anymore and the protection is really gone, because I've tested this.
So you better trust the System Status Screen than the "ShadowMode"-label on your desktop.

It seems to me that you have to disable ShadowMode in the current snapshot and then you can boot in the other snapshot. I'm going to test this further, but it's not a good sign.
Turning off protection isn't good and certainly not in my on-line snapshot.

My off-line snapshot is constantly in ShadowMode and I only have to turn it off, when I want to install/uninstall softwares, which happens rare.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
  #5  
Old September 25th, 2007, 02:01 PM
L Bainbridge L Bainbridge is offline
Regular Poster
 
Join Date: May 2006
Location: London,U.K.
Posts: 173
Default Re: ShadowDefender & FirstDefense-ISR

Quote:
Originally Posted by ErikAlbert
If ShadowMode = ON in both snapshots, you can't use the function "Boot to snapshot" of FDISR anymore. FDISR keeps on rebooting in the current snapshot, instead of the other snapshot.
The only way to solve this, is using the F1-key, but that doesn't solve the problem entirely.
If you do this, the other snapshot has still the "ShadowMode"-label, but the protection is gone according the System Status, partition [C:] has no blue color anymore and the protection is really gone, because I've tested this.
So you better trust the System Status Screen than the "ShadowMode"-label on your desktop.

It seems to me that you have to disable ShadowMode in the current snapshot and then you can boot in the other snapshot. I'm going to test this further, but it's not a good sign.
Turning off protection isn't good and certainly not in my on-line snapshot.

My off-line snapshot is constantly in ShadowMode and I only have to turn it off, when I want to install/uninstall softwares, which happens rare.

Ok I can see that's a problem.
But a solution would be to make your off line snapsot frozen and Shadow only the online snapshot.
I use SD/ FD-ISR that way without any problems
  #6  
Old September 25th, 2007, 03:02 PM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 11,808
Default Re: ShadowDefender & FirstDefense-ISR

I can see where using any of the shadow type programs, and leaving them shadowed and moving around FDISR snapshots, is going to be problematic.

I just use them in the primary snapshot period.
  #7  
Old September 25th, 2007, 04:17 PM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default Re: ShadowDefender & FirstDefense-ISR

Quote:
Originally Posted by L Bainbridge
Ok I can see that's a problem.
But a solution would be to make your off line snapsot frozen and Shadow only the online snapshot.
That is more a workaround than a solution. ShadowDefender is supposed to replace my "Freeze Storage.arx" and make each snapshot frozen. I remember vaguely that Returnil had the same problem, after a short test.

SD/Returnil certainly don't work PER snapshot, they work somewhere above FDISR and get confused, when you boot in other snapshot. In other words, I can't get rid of my frozen snapshot.

Freezing my off-line snapshot isn't really an improvement, because it's my largest snapshot and that means a bigger "Freeze Storage.arx". I work in that snapshot, because it's quiet there.
I'm not so enthousiastic anymore about SD and paying $35 for a 50%-solution is not good. In that case I better use Returnil.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
  #8  
Old September 25th, 2007, 06:05 PM
L Bainbridge L Bainbridge is offline
Regular Poster
 
Join Date: May 2006
Location: London,U.K.
Posts: 173
Default Re: ShadowDefender & FirstDefense-ISR

At the risk of sounding like Easter - what about Power Shadow 2.6/ 2.8 flavours?
I have a suspicion however that theoretically what you are seeking (i.e. 2 simultaneous shadows in FD-ISR) cannot be achieved.
Logically if shadowing is doing its job it will prevent FD-ISR console changing snapshots as all actions within that OS are discarded on reboot, meaning the FD-ISR boot switch will also be discarded.
What is interesing and I'm not sure I understand is why boot switching using the F1 prompt in the FD-ISR pre-boot should drop you out of shadow mode on rebooting.
That could be related to the way shadowing is achieved in SD/ Returnil & could be different in Power Shadow.
Clearly the developer is not going to tell us how they achieve shadow mode so a work around or 50% solution maybe the best you will achieve.
It would be interesting to know whether the same problem occurs with Deep freeze & FD-ISR as well.
  #9  
Old September 25th, 2007, 07:01 PM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default Re: ShadowDefender & FirstDefense-ISR

Quote:
Originally Posted by L Bainbridge
It would be interesting to know whether the same problem occurs with Deep freeze & FD-ISR as well.
If I'm in the right mood tomorrow, I might try this combination, but my expectations aren't big.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
  #10  
Old September 25th, 2007, 10:06 PM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default Re: ShadowDefender & FirstDefense-ISR

L Bainbridge,

My first attempt of installing DeepFreeze in
1. Off-line Snapshot AND
2. On-line Snapshot
was a disaster. I'm not surprised, it was predictable.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
  #11  
Old September 26th, 2007, 02:29 AM
L Bainbridge L Bainbridge is offline
Regular Poster
 
Join Date: May 2006
Location: London,U.K.
Posts: 173
Default Re: ShadowDefender & FirstDefense-ISR

ErikAlbert

As you said sadly predictable.
One further thought- I've never used Shadow User but I understand that it only goes into shadow mode on reboot. If you use this it could (in theory!!) work with FD-ISR boot switches but the problem will be the need for repeated booting to enter Shadow modes in each snapshot.
Only a thought....

Good luck
Lee
  #12  
Old September 26th, 2007, 06:17 AM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default Re: ShadowDefender & FirstDefense-ISR

Quote:
Originally Posted by L Bainbridge
ErikAlbert

As you said sadly predictable.
One further thought- I've never used Shadow User but I understand that it only goes into shadow mode on reboot. If you use this it could (in theory!!) work with FD-ISR boot switches but the problem will be the need for repeated booting to enter Shadow modes in each snapshot.
LOL. I know what you are doing. You are challenging me to combine any existing Immediate System Recovery software with FDISR, but I'm getting tired of all these experiments WITHOUT any progress.
It's obvious to me that you can install these softwares only in ONE snapshot and not in more than one snapshot without getting in trouble and I certainly don't need a recovery solution that fails all the time.
These softwares are just not designed to work within FDISR.

I restored my actual system back to catch up with my video-editing.
When I'm back in the mood, I will try ShadowUser one day.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
  #13  
Old September 26th, 2007, 06:33 AM
pandlouk's Avatar
pandlouk pandlouk is offline
Very Frequent Poster
 
Join Date: Jul 2007
Posts: 1,867
Default Re: ShadowDefender & FirstDefense-ISR

Hi ErikAlbert,

none of these shadow products will work the way you wnt them. You can install them on multiple snapshots but you will have to enter manually in shadow mode.

ps. The only program that can achieve what you want is the one you hate most. Rollback RX
__________________
Main protection: AppGuard or SRP, USB protection, Windows firewall with Windows Firewall Control & CfosSpeed firewall
Backup and Recovery: FirstDefense-ISR, AX64 Time Machine, Image For DOS/Linux/Windows, BootIt™ Bare Metal, 1-Click Restore
  #14  
Old September 26th, 2007, 08:34 AM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 11,808
Default Re: ShadowDefender & FirstDefense-ISR

Shadow Defend and Returnil both work well within one snapshot. ShadowUser was one I tested that failed Killdisk, and yes you need to reboot to get inito shadow mode.
  #15  
Old September 26th, 2007, 06:05 PM
L Bainbridge L Bainbridge is offline
Regular Poster
 
Join Date: May 2006
Location: London,U.K.
Posts: 173
Default Re: ShadowDefender & FirstDefense-ISR

Quote:
Originally Posted by ErikAlbert
LOL. I know what you are doing. You are challenging me to combine any existing Immediate System Recovery software with FDISR, but I'm getting tired of all these experiments WITHOUT any progress.

I restored my actual system back to catch up with my video-editing.
When I'm back in the mood, I will try ShadowUser one day.

Well, there's an English expression : 'Why keep a dog & bark yourself!!
Seriously, I do think you are going to find it difficult to find a software that works in this way with FD-ISR...

As a final ?wild thought - What about using Rollback Rx plus FD-ISR using semi-frozen snapshot system by setting Rollback to roll back to previous snapshot on each reboot.
I've been using Rollback 8.0 for a while now on my kids' pC & it seems to have become much more stable than in the past. (I wasn't a fan either...!).
I know others have said that both progs. do work together well.
good luck
Lee
  #16  
Old September 26th, 2007, 07:11 PM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default Re: ShadowDefender & FirstDefense-ISR

Quote:
Originally Posted by L Bainbridge
As a final ?wild thought - What about using Rollback Rx plus FD-ISR using semi-frozen snapshot system by setting Rollback to roll back to previous snapshot on each reboot.
I've been using Rollback 8.0 for a while now on my kids' pC & it seems to have become much more stable than in the past. (I wasn't a fan either...!).
I know others have said that both progs. do work together well.
good luck
Lee
Straight from "Compare and Contrast: Rollback Rx Pro vs. FirstDefense-ISR" regarding combining both softwares :

Quote:
To recap, HDS thinks that the installation of RB Rx and FD-ISR on the same machine to be extremely unwise; we strongly dissuade the reader from taking this step. WE WILL NOT PROVIDE ANY TECHNICAL SUPPORT FOR PROBLEMS ARISING FROM INSTALLING BOTH PRODUCTS ON A SINGLE MACHINE. Users insisting on such an installation must rely completely on their own resources. Or, alternately, you might approach the people or institutions whose advice you took.
http://supportcenteronline.com/dmfil...Vs_FD2_v2.pdf?
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
  #17  
Old September 27th, 2007, 01:51 AM
pandlouk's Avatar
pandlouk pandlouk is offline
Very Frequent Poster
 
Join Date: Jul 2007
Posts: 1,867
Default Re: ShadowDefender & FirstDefense-ISR

Quote:
Originally Posted by ErikAlbert
Straight from "Compare and Contrast: Rollback Rx Pro vs. FirstDefense-ISR" regarding combining both softwares :


http://supportcenteronline.com/dmfil...Vs_FD2_v2.pdf?
I know of this document. And I agree that it is extremly unwise for beginners, medium/average and advanced users. But:
1. The two softwares do not conflict with each other.
2. A power user rarely contact support, mainly for reporting bugs.
3. If as I believe you already know how flexible is FD-ISR, combined with Rollback RX their use is restricted only by the limits of the user's immagination.

ps1. I use FD-ISR as a multiboot system of an XP-main snapshot, an XP-Stripped/game snapshot and a Vista-Snapshot. Rollback as a restore application.
ps2. I do not reccommend either using them together either. But is the only combination that can achieve what you want.
__________________
Main protection: AppGuard or SRP, USB protection, Windows firewall with Windows Firewall Control & CfosSpeed firewall
Backup and Recovery: FirstDefense-ISR, AX64 Time Machine, Image For DOS/Linux/Windows, BootIt™ Bare Metal, 1-Click Restore
  #18  
Old September 27th, 2007, 08:54 AM
Peter2150's Avatar
Peter2150 Peter2150 is offline
Global Moderator
 
Join Date: Sep 2003
Posts: 11,808
Default Re: ShadowDefender & FirstDefense-ISR

Quote:
Originally Posted by pandlouk
I know of this document. And I agree that it is extremly unwise for beginners, medium/average and advanced users. But:
1. The two softwares do not conflict with each other.
2. A power user rarely contact support, mainly for reporting bugs.
3. If as I believe you already know how flexible is FD-ISR, combined with Rollback RX their use is restricted only by the limits of the user's immagination.

ps1. I use FD-ISR as a multiboot system of an XP-main snapshot, an XP-Stripped/game snapshot and a Vista-Snapshot. Rollback as a restore application.
ps2. I do not reccommend either using them together either. But is the only combination that can achieve what you want.

Rollback and FDISR did work for me but it was a bit shakey. Occasionally on swapping FDISR snapshots, I'd have chkdsk run. That is trouble some. Also imaging was a pain. With just FDISR, I'd just image, windows or recovery CD it didn't matter. But with the combo, I would need to take Rollback back to the baseline, losing snapshot, and then I could only image with the recovery CD, if I wanted an intact restore.

For me since the only reason for Rollback was a bit faster operation, that advantage was lost with the imaging issues.
  #19  
Old September 27th, 2007, 11:32 AM
ErikAlbert ErikAlbert is offline
Incredibly Massive Poster
 
Join Date: Jun 2005
Posts: 9,456
Default Re: ShadowDefender & FirstDefense-ISR

Pandlouk,
Peter showed clearly that this combination is troublesome and that's what interests me.
My experience until now is that none of these other ISR-software can be combined with FDISR without getting in trouble.

The difference between Peter and ErikAlbert is :
1. Peter has only ONE work snapshot and that's why he has less or no problems with other ISR-softwares.

2. ErikAlbert has TWO work snapshots and when he installs other ISR-softwares in each snapshot, he gets problems, because they can't handle more than one work snapshot.
FDISR is designed to create different work environments and that feature is working fine. Thanks to FDISR, I have now an off-line computer without troubles and an on-line computer with possible problems.
I need my off-line snapshot for several reasons, but I wanted a quiet environment in the first place without any disturbance and it works.

Final conclusion : I can't use any of these other ISR-softwares.
So I keep FDISR and wait until the shortcomings of FDISR are solved.
__________________
ErikAlbert
Security = WinXPproSP3 Firewall + Anti-Executable + DefenseWall HIPS * Recovery = ShadowProtect + FirstDefense-ISR
Malware Survival Rate = 0.00%, but each malware has my sympathy.
  #20  
Old September 28th, 2007, 02:58 AM
EASTER's Avatar
EASTER EASTER is offline
Massive Poster
 
Join Date: Jul 2007
Location: U.S.A. (South)
Posts: 4,521
Default Re: ShadowDefender & FirstDefense-ISR

Quote:
At the risk of sounding like Easter - what about Power Shadow 2.6/ 2.8 flavours?

Since you've already commited yourself to that generous recommendation L Bainbridge of one of my most cherished and what i consider greatly under-rated virtuals now that Returnil + Shadow Defender have surfaced....

I'll add also that although it's great for those like myself since SandboxIE is compatible along with a myriad of many other common HIPS apps, you'll find ErikAlbert to everyone's benefit is on a constant quest in pushing the envelope toward a more automated TOTAL & CLEAN PROTECTION method.

I'll be the first to admit that i seldom rely BLINDLY on any app that has virtually no support (In English) or updated, but i've done just that with PS.

Erik expresses a reasonable apprehension about it and so dismisses it from that quest if i follow things right.

I also depend HEAVILY on FD-ISR and more importantly it's ARCHIVES offline for a dependable immediate recovery solution.

One For Erik: Like you i'm anxiously awaiting a newer featured version of FD and not just the Vista compatible changes. Vista is grossly slowed down progress for many softwares just so that they can bring their designs to work in them too.

FD-ISR does a most remarkable job as-is when used as intended, but there are yet even more & better improvements that are yet to be realized with it leaving the door wide open to Leapfrog's imagination, and they do read our wish-lists as well as our interests & ideas for improvements.
__________________
★AX 64 Time Machine★
★Shadow Defender★| EQSecure v4.0 |#Sandboxie 4.08 beta# |FirstDefense-ISR|★FileChangeAlarm★ |Registry Backup VSS|
Maxthon 4 | X Iron 17.0 | Chromium 19.0 | Pale Moon 20.1

Microsoft Windows 8 64bit (UEFI/GPT) Secure Boot¶
¶Linux Mint 14 MATE¶
  #21  
Old September 28th, 2007, 02:59 PM
L Bainbridge L Bainbridge is offline
Regular Poster
 
Join Date: May 2006
Location: London,U.K.
Posts: 173
Default Re: ShadowDefender & FirstDefense-ISR

Easter

I have a sneaky feeling that after being a big Shadow Defender fan I might just prefer PowerShadow 2.8. I'm getting concerned re: Peter's horrible snarl ups with SD even though I cannot reproduce them & I know PowerShadow was rock solid on my box for over six months.
Plus at the moment it does the one thing Returnil can't do at present - shadow more than one partition.
Maybe it's time to change the signature again....
 

Wilders Security Forums > Software, Hardware and General Services > sandboxing & virtualization « Previous Thread | Next Thread »

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Settings
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -4. The time now is 10:54 PM.


Powered by vBulletin® Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Copyright ©2002 - 2013, Wilders Security Forums