can i have full access to an usb stick ?

Hi

can i have full access to an usb stick under sandboxie ?

under file access ,both enabled for the usb stick letter F:
direct acess
full access

why doesn't it work?
i can't write or format

thanks

 

That is very interesting and useful. Is there any way to exclude a particular drive from sandboxing, as I have a large USB SSD permanently attached for backups.

 

hi
i use the classic version 5.69.6 , i haven't in these settings in global control
from the ini file
[GlobalSettings]

Code:

[GlobalSettings]

ByteOrderMark=yes
ForceDisableSeconds=10
FileRootPath=c:\Sandbox\%USER%\%SANDBOX%
ActivationPrompt=y
Template=WindowsLive
Template=nVidia_Stereoscopic3D
Template=OfficeLicensing
Template=AdobeLicensing
Template=Babylon
Template=NOD32

 

hi
do you think could be done with the classic version?
thanks

 

Hi Mantra. When you give Direct access, you give permission to "programs that are installed" in your computer outside the sandbox to have access to specific files or folders when they run in a sandbox. This permissions allows programs to modify files and folders bypassing the sandboxing effect. Using this setting is pretty safe. This is because programs that you install outside the sandbox are programs that you know well and you know are clean. The setting allows you to give the access to All programs that run in the sandbox, but it is safer and the better way to use this setting is to give the access to particular programs and for an specific purpose. For example, if you run your Word program you can allow word.exe Direct access (or whatever the exe for Word is called) to the Desktop so you can make changes to Word files located in the Desktop when you edit them, by doing this, you bypass the sandboxing effect.

Regarding Full access, you should use this setting for programs that you install in a sandbox. When you give Full access, you are giving the access to all program that run in the sandbox including programs that are downloaded into the sandbox (this means any program, including malware if malware is DL automatically into the sandbox) or programs that you install in the sandbox. In your particular case, using this setting is OK if you download an exe, you know for sure that it is a clean program and you install the program in your USB sandbox. This, is really the only reason for you to use Full access in your USB sandbox. You certainly don't want to give Full access to all programs that run in the USB drive. Doing that is pretty unsafe.

This settings are safe if you use them wisely. Use them as little as possible and only if there is a good reason for you to use them.

HTH

Bo

 

hi @bo elam

well , i have tried without luck , i can't format the usb stick , even acess
i think i should try the last official sandboxie ,the old one ,maybe it does work

 

Hi Mantra. Perhaps what you are trying to do with File Access settings is not what can be done with those settings.

Remember, this settings are for allowing programs that run or are installed in the sandbox access to files and/or folders that are in the computer located outside the sandbox. When you use this settings, you do it for convenience (bypassing the sandboxing effect to make changes to a file or folder). In exchange for this convenience, you open a hole in the sandbox (the access).

What is it that you want to do? If you can not answer the following question, then this settings are not for the purpose you have in mind: Which program is it that you want to allow access to a file or folder that is located outside the sandbox?

Bo

 

Mantra, look at the picture below. That is what Full access looks like when I allow Full access to Irfan view to make changes to pictures I have in my Desktop. By using the setting the changes to a picture go straight through, with no need to use the Recovery function. That is the purpose I use the setting and the reason I use Full access is because Irfan view is installed in a sandbox. If Irfan was installed outside the sandbox like a regular program, then I would use Direct access. Direct access does not work for programs you install sandboxed.

Bo

 

hi Bo
many programs do works ,some of them can 't even see the usb stick
maybe some software do use a low level ..
thanks

 

Mantra, knowing this might help you, a Forced USB drive works the same as a Forced folder. When you Force the USB Drive, nothing runs sandboxed unless a file located in the sandboxed flash Drive is executed.

Bo

 

Got this working with no problems Interestingly, SB doesn't see my external NVME USB as a USB drive so it's not sandboxed - in this case that's what I want but not great from a security viewpoint. Disk Management sees it as a "basic drive" rather than a removable drive which I assume is the reason; it's also Bitlocker encrypted which I suppose could have an effect.

 

hi henryg1 and @bo elam
do you mean with sandboxie classic , you can't format or perform operation to the ssd with program under sandboxie even full access , can' you?
thanks

 

Nope SB+

 

Maybe I am not understanding you correctly but if I am, for some reason that is how it works (always has), but after you plug the drive the first time, you then should be able to make the Drive, the letter, a Forced folder. Afterward, next time you plug that Drive, programs and files that run out of it, should run sandboxed.

Edit: Also, SBIE sees a Forced Folder or a Forced USB Drive as a regular folder . The sandboxing effect only takes place when you execute a file that is located inside the Forced Folder/Drive.

Bo

 

Mantra, I am using Classic.

Bo

 

Bo, I don't want to force it; it suits me as is. But if there is a facility to (auto) Sandbox USB drives, it should initially apply to all without manual intervention IMO.To my mind, it's a security risk even though I am happy with it.

 

In old Sandboxie, the way forcing the USB Drive worked was a little different than how it does now in David's version of the program. In original SBIE, when you plugged in a flash drive, the drive would automatically open/run using a sandboxed version of File Explorer. IMO, that was powerful and something real good for people who plug other people's USB drives in their computers (bad to do). And then after you closed the sandboxed File Explorer, if you kept the drive plugged, and you navigated back to it, SBIE would see the drive as it does now, as a Forced folder, and if files that were in the drive were executed, they would run sandboxed in your USB sandbox.

So, if you don't want to force your USB Dives, you could open a sandboxed File Explorer and use it for navigating to the USB drive to run files. Anything you run, would run sandboxed. This is very safe. If you plug flash drives often, for covenience, you can create a sandbox for File Explorer and create a sandboxed shortcut for sandboxed FExplorer. I don't use flash drives often or plug other people's flash drives in my computer but I force USB drives and also have a sandboxed shortcut for File Explorer just in case a good reason to use one comes about.

Bo