virtual os or returnil

If you use returnil or if you virtualize your entire operating system with some other software, does that mean that NOTHING would actually be written to your hard drive? I

 

The short answer is no. If you use a light virtualizer with that expectation, sooner or later you will be disappointed.

 

A virtual operating system still writes to your hard drive,it's just that it's an isolated area of the disk.Running a "live" cd O/S is the only way to accomplish what you ask.

 

Shadow Defender has an option to create the virtualization cache in RAM, instead of writing the redirected sectors to the disk.

 

so does returnil2008 which i'm still using

 

That was the best version of Returnil IMO,before the addition of the AV.

 

Even it the cache is kept in RAM, SD can write to the "real disk". For example, virtualize the active partition and modify the BCD. You will find that the changes remain after rebooting. Or simply change the SD configuration, the same happens.

 

Thanks guys for reminder of RVS 2008...I still have it in my archive so there was no way not to install and try it at once I'm surpised and impressed how functionaly and useful was RVS in that version...anti-exe, whitelisting, lock-mode, RAM cache, additional mounted virtual disk, auto-runs and probably registry change saving...just great. Only one question...why people forgot about it?

 

It is true that there are changes that can be made, which will be written to the disk (the same is true if exclusions are made); but whether or not disk writes will actually occur depends on how the system is used while in Shadow Mode and whether a sufficiently large RAM cache is allocated to the virtual session.

 

Can anyone give me some guidelines as to how much RAM is needed and/or should be allocated for RAM caching in SD - or Returnil 2008 - on a Windows XP SP3 system with a small 80GB internal HDD (about 45% full) and 2GB of RAM?

 

In my XP SP3, similar to your system, I have never enabled the Ram option while using Shadow Defender but when I used WTF, I had the option on all the time (over two years) at 800MB. My XP in idle uses 200MB, normally if I use SD, I ll use it for a couple hours and reboot. If I was to use the Ram option in SD, I think 550/600MB would be the perfect amount for my case use.

Bo

 

Tom,

While Bo's suggestion may work well with your config, it's my opinion that you won't see very much performance difference when in Shadow Mode with or without RAM allocated for SD cache. On the other hand, allocating too much of your 2GB RAM to SD cache could very well adversely impact Windows performance! 'Play' with it and see for yourself.

TS

 

Thanks Bo and TS -- both helpful. I primarily use SD for testing new software, so maybe the RAM option is not all that important or necessary when used this way. Right?

Tom

 

I also think there is no change in SD performance/speed having the cache in RAM. With My Win8 (64bit) I allocated 4 out of 8GB and there was no perceived change. With my Vista I allocated 1 out of 2 GB and again I could see no change, as a matter of fact with Vista I reverted to version .325 which gave me the impression of being faster. These results could of course vary with different machines and OSs.

 

Supposedly, running Shadow Mode with RAM-cache is faster and more secure than with HDD-cache, but imho neither benefit makes a substantial difference and in your situation it's not worth the penalty of depriving Windows of RAM (should you allocate any meaningful amount to SD).

Of course for those who have an abundance of RAM it makes more sense to allocate some of it to SD, but that's not the case with your config, so I would stick with HDD-cache.

TS