The unofficial Shadow Defender Support Thread.

We have a winner.
Turning Shadow Mode only on C, no problems.
As soon as I check one of other two HDD's (or both) I have that popup.
So basically with all 3 checked C is in Shadow Mode but other two not quite.

 

Try use excubits pumpernickel. It will tell u what is trying to read and write on ur HDDs. Run in audit mode.

 

Try this http://web.archive.org/web/*/http://excubits.com/content/files/*

Unfortunately pumpernickel is the only one missing... I might have it on one of my old macrium images, I have one from 28th december 2018. But idk how to open .mrimg without macrium (and I dont want it right now), anyone knows? Extracting or whatever would work fine.

Alternatively, open task manager, enlarge, open performance tab, click on resource monitor, go to Disk tab, expand Disk activity, sort by File, this will tell u what process is writing to ur HDDs

or try this https://www.raymond.cc/blog/find-out-what-program-is-secretly-accessing-your-hard-disk-drive/

 

I have/had it too. (In the past more often, in the meantime only seldom.)

I have kept the comment that the developer of ShadowDefender (Tony) once has posted in a Forum:

 

Does it work on ssd ?

 

Yes it does, having an SSD will speed up rebooting out of shadow mode as a normal reboot.

 

It was said that it was breaking ssd. did they fix this problem?
usage time was decreasing. shadow mode was breaking

 

Who said and where

 

Same. I have no problems with my system partition on an SSD either.

 

I've never read anywhere that SD might break SSDrives. If it shortens an SSD's life, we'll have to wait for some empirical evidence, time will tell. Considering that most computers sold in the last 3 years have an SSD as standard hardware I doubt the developer isn't aware of any incompatibility. As far as I'm concerned, switching to an SSD in my computer was like transforming a normal car into a racing one, and SD operations were also dramatically affected in terms of speed ...

 

at least two people on this forum said , (quoting the maker of the programme) that this information can be ignored and that you can click OK

I believe I asked the same question

 

Ok wtf is this now, this was working prior to installing SD:

 

It looks like 10 is running like a rootkit, wants the ultimate 'say' and is trying to prevent us running a third party application that runs from a driver at root level. Tony recommends that we turn off fast boot...also known as fast boot, hiberboot and other names. What happens (I think) is that when you have fast boot on, 'dows doesn't really shut down properly, goes into a sort of vitual mode and remains active.
Shadow Defender needs your system to shut down 'clean' to impose it's own settings and your settings that you've configured within Shadow Defender shadow mode, on your real system, at boot.
I've heard, though, that when we turn off fast boot it will turn on again when 'dows upgrades next disregarding any previous user settings.

diskpt.sys is a necessary file to run Shadow Defender.

This is my layman's 'take' on what is happening. Anybody, please feel free to correct me if I'm wrong

Basically though, the messages that you got above seem to be saying that 'dows thinks that you should get rid of Shadow Defender because it's in it's way and that it should be the ultimate gatekeeper and security, privacy arbiter.

nb This message was edited by me to change a mistake, 'secure boot' to the correct 'fast boot'

Patrick

 

I'm not an expert here by any means, but Secure Boot and Fast Startup are not the same?
I think the former is a UEFI firmware setting, the latter is a power configuration setting which relies on hibernation being enabled?

 

Yes, of course, you are right, I hadn't noticed that, I'll re-edit.

 

So I assume you meant fast boot instead of secure boot? And tony (is this the main SD dev?) meant fast boot too?

 

Yes, Tony is the Shadow Defender developer.

Frequently Asked Questions
here
'Q : Why Shadow Mode works only if I restart the computer? If I shut down the computer, all changes remain after reboot.
Fast startup is turned on by default in Windows 8/10. When it is turned on, Windows will take hibernation instead of shut down, so after reboot all changes will remain. To discard all changes made in shadow mode after shut down, please disable fast startup.'

 

Well I have fast startup disabled

So idk why sd's the driver is the only one on my system that wont work with memory integrity, and why won't the dev make it work with it

That said, my pc literally boots in about <10 sec since all bios compatibility **** is disabled. All mouse usb ps/2 and whatever ports and stuff is disabled while booting. All devices are disabled (except system ssd). Windows logon is disabled (automatic logon with netplwiz). So it boots very fast. Restarts in about 20 sec. And Im using MX500 so it's not even that fast ssd. But fast startup is disabled here.

 

Saving changes when the computer is turned off
You must have Fast Startup and hibernation enabled, and the "Allow hibernation in protected mode" checked in the SD settings.
If you now turn off (NOT reboot!) the machine through the Start button, and not through the SD interface, the results of the shadow session will be saved (not in the sense of rebooting, but as in hibernation mode). This is an undocumented SD feature.
After turning off the computer, you can completely disconnect the power.
The results of the shadow session will be saved, and then turning on the computer will continue the shadow mode, but the floating SD window will not be displayed. Let's start SD and see that the "C" partition is still protected.
To exit protected mode, you need to act through the SD interface and then shutdown or restart the computer.
Hint
The above works when the machine is turned off, and does NOT work when the machine is restarted!
In Windows 10 and 8.1, Fast Startup is enabled by default.

If FastStart is enabled in Windows 10 or 8.1:
- computer shutdown - changes made in the shadow mode are saved (because the machine does not actually turn off, but goes into sleep mode);
- restarting the computer - changes made in the shadow mode are not saved;
If FastStart is disabled in Windows 10 or 8.1:
- shutting down the computer - changes made in the shadow mode are not saved;
- computer restart - changes made in the shadow mode are not saved.

 

Reading the last paragraphs, this made me think, enabling fast startup (while bad in itself) gives u the advantage that u can choose to save the changes by "shutting down" the pc. But if you have fast start disabled, both shutdown and restart do not save the changes... So is there a way to restart pc AND save the changes in SD?

And what does enable hibernation in SD do when fast startup is enabled, and when it is disabled?

 

Alas, this is not possible in Shadow Defender. This could once have been done in Shadow User.

Allows hibernation when SD Protected Mode is enabled.

 

Actually there is a way to save all changes when rebooting out of shadow mode, although it hardly makes any sense most of the time, as the purpose of SD is to protect by discarding all changes.

You should open the main SD GUI and check off the volume that is currently in shadow mode. This will offer another operation which was previously greyed out ‘Exit Shadow Mode’. If you click it, it will produce a window which will give you 2 options: ‘Discard all changes except the exclusion list (recommended)’ or ‘Commit all changes’. The second option should reboot the system keeping all changes.

I remember trying this option with XP and Vista out of curiosity and it worked, I have not tried with Windows 10 20H2 therefore I cannot vouch for its reliability. I guess it would be helpful if complex changes were made to the system whereby remembering details would be difficult, but in a similar context I would definitely deem creating an image of the system more reliable. SD was not really designed to keep changes. Before trying out this option I would backup the system just in case errors occurred.