Sandboxie v2.86

Always learning something. I thought SP would recover from something like that..
Peter: what is it that stops SP from recovering from that specific situation?

 

Zero is not the same as format. According Western Digital, my zero program results in a NEW harddisk.
I always use that program when I reinstall from scratch.

The clean program of PartDisk overwrites EVERYTHING with zeroes. So there is no difference with my program.

 

Well, my problem of "Direct OCR Error" seems to be gone, since I removed the bar "Canon Easy-WebPrint" in MSIE.
Tzuk was glad, I could solve it this way.

 

Hi Peter, I am not sure but long ago when I tried Killisk I did not need to use DiskPat. I simply formated and installed XP by booting from XP CD( if I remember well I am not sure), can u check it?
Did u tried it against Freezed snapshot and ShadowUser/ Surfer/ PowerShadow etc?

 

Peter,
Thanks for the testing, I knew how nasty killdisk was, but I was never worried about it. Now we know for sure what to do in such disaster scenario.
And Sandboxie did a very good job and that is also good to know.

 

One last question: so SP doesn't restore the partition table, only MBR?
Shouldn't a program like this restore everything for a working OS?
I'm sorry if these Q's look really dumb.. but this seems like a disaster for a "disaster recovery program".

 

I suspect ShadowUser/ Surfer etc might survive( I read here on forums but not sure).
Eaz_fix has survived here too.

 

Your reasoning isn't so bad at all. I would also expect from the Acronis Rescue CD, that it would restore an image from my external harddisk without troubles, no matter what is on my harddisk.

Of course it is standard procedure for me, to zero my harddisk and then restore an image after a malware attack, but this has nothing to do with what happened.

 

Digressing a bit here if I may, but one of my primary reasons for liking this software (enough to register), is it's convenience, aside from all the security benefits (and they are substantial).
Before SandboxIE, I was constantly turning cookies on/off (depending on site visiting), as well as Java, JavaScripting, etc. Made me crazy.
OK, I'm at Wilders, cookies on. Browsing elsewhere, cookies off. Other trusted sites, damn, they're not rendering correctly, Java/JavaScript on.
Constantly clicking permission stuff depending where on the web I was.
At the end of sessions, I was constantly reviewing, subsequently selecting/deleting cookies, as well as clearing history, etc.
Ahhhh....With SandboxIE, I find the browsing experience much more relaxed.
Cookies, Java, JavaScripting, all ON.
Browsing done, close browser, EVERYTHING gone.
Simplistic approach. I like simple.

 

Actually, you're not , and i also agree with you. Everything is in one place, where i can get rid of in a click or two.
I also have everything on, except cookies (go figure). With Opera, the few sites i want cookies for, i enable it for them.

 

I usually open all my trusted sites outside the sandbox with all my login details saved in FF's cache and password manager.

Then everytime I empty the sandbox and start a new FF sandboxed browsing session the login details are resandboxed and retained hence speeding things up.

I have set CCleaner not to clean FF as emptying the sandbox gets rid of all other unwanted cookies and cached sites that are picked up in any browsing session.

 

Thanks for the info.
I realize by your tests/details (thanks btw) that most if not all would fail, but still i suppose SP should restore everything anyway. It holds how the HD was formatted, files, MBR et al, it should restore the information it holds on the HD when the image was taken.

 

Peter,
You don't need a blank drive to restore an image, the image just restores over the existing harddisk. I've done this so many times. The contents of harddisk doesn't matter at all during a restoration.
If the CD didn't work after the killdisk, it means that CD isn't good enough.

The question is : if you didn't had DiskPart, would the CD have restored your harddisk or not ?

 

OK. That's good enough for me, but restore right after killdisk without using DiskPart. This should work properly, otherwise there is something wrong. After all not every user has DiskPart or any other zero program.

After that you can use DiskPart to be sure that everything is gone and restore again.

PS: I thought Acronis CD didn't work on your computer due to mouse problems ?

 

Yes it puzzles me indeed, that you couldn't restore an image with an ATI/SP Recovery CD, right after a killdisk attack.

The Acronis Rescue CD is able to restore an image on a ZERO-ED harddisk, which is even worse than killdisk, because there is nothing anymore on a zero-ed harddisk.
BUT it can't restore an image after a killdisk attack, that is SOOO UNLOGICAL.

That makes any Recovery CD of any image backup software WORTHLESS after a killdisk attack. That is almost UNBELIEVABLE for me.
I'm very disappointed in this, I hope that somebody of ShadowProtect is able to explain this to me, because this will be my next Image Backup Software. Pffft.

 

I can,t believe this as well.

Peter two Qs for u.

1- Are u doing all this on VM? If yes, then I will suspect the results might be different on real hardware. VMs can,t be 100% real many times.

2- When u failed with ATI and SP, did u try to insert an XP CD and see if it allows u to reinstall XP( without running DiskPart as I think I did like this in the past( but not sure). If XP CD allows a reinstall of windows then it might be OK for a normal user.

3- What is disk part?

 

Scarry. I am still doubtfull as I know very well that SS/ SU protects MBR.

Here is the flaw. When u reached Eaz-Fix pre-boot screen, did U try to restore just to the last snapshot taken before running KillDisk? I have done it and EAZ-FIX boots into all snapshots OK. U just loose ur curent working state, nothing else by KillDisk. I am very much sure.

Sorry as I did not understand it at all. Also where is the try with FDISR.