Hardware based snapshot/rollback

A while ago I posted a question about hardware based snapshot/rollback cards.

Now after being in contact with several manufacturers they said these cards work in conjunction with a driver

For example, see the Radix Reload PCI card here which needs a driver in order to redirect writes to a separate area on disk. This places these card in the same area as their software based counterparts

I was under the impression that a driver was optional...

Do PURE hardware based snapshot/rollback cards (or controllers) even exist?

 

I have/had what I consider a good cache card, CoreRestore, which unfortunately broke at the end of 2009 and I'd give anything to fix it or buy a used one. They stopped making them several years back and I could only use it on my older test machine because of the requirements to hardware.

It sat on the board attached to hard disk intercepting writes, restoring the system on reboot although it could do more and worked independently to the system. Its on board chip did all the work.

Erik as to your question I'm unsure but you sound like you're in the market for one. Please, if you find one that your happy with, please let me know about it.

edit : I just looked at your other post. You mentioned you checked out CoreRestore, does cfs-llc dot net have newer or similar products?..Have you looked at CoreShield? - okay this looks more like an aid to forensics in preventing writes so that a hard disk can be examined, I already have a solution for this I would like something similar to CoreRestore again.

 

cfs-llc dot net cannot be emailed. All my emails are rejected:

#5.5.0 smtp;550 #5.1.0 Address
rejected sales@cfs-llc.net

I think they have issues with their domains (also www.coreprotect.com is gone).
I'll try to contact them on Monday by phone.

Meanwhile I am searching for something similar but so far no luck. I can't believe no one offers a similar product

I am beginning to consider in developing a SATA based solution. I am sure a lot of people would also be interested in such solution.

 

I was thinking the very same or looking to find someone to do the work, consider me your first customer and tester.

Yes what CoreResore lacked unless physically hacked. If you look into building this consider a plug-in/on so that it can be universal.

Yes I've tried to contact them before and got the same. If you have any luck, order two!!.please let me know I've even scoured the web in the past for a used one with no success.

Btw a lot of the cards I've come across are usually quite cheap and do not come anywhere near CoreRestore.

 

I just found these two products from Voom Technologies.

Instant Save Instant Restore (ISIR)
http://web.archive.org/web/20080801023448/http://www.voomtech.com/isr.html

Instant Recall
http://web.archive.org/web/20080616103959/http://www.voomtech.com/ir.html

Voomtech's CURRENT website has no information about these products

Anyone have experience with one of these products?

 

None that I know.

But HyperDrive5 64GB max + 2009TE SuperGeek £329.00 is probaly the closest sollution for what you are looking for.

Panagiotis

 

Very nice piece of hardware but the SuperGeek feature needs an MBR to boot from and the MBR could get compromised by malware I think. Nonetheless, great hardware but not exactly what I am looking for.

I wish there is manufacturer that builds hardware like the CoreRESTORE. SATA preferably. I have some good money to spend on such hardware

 

Not necessarily. You can combine it with a RiData 150X CF Card with Write Protection
Install the OS and Supregeek on the CF card and then enable the write protection. Nothing will be able to infect this combo.

Panagiotis

 

Now that I rechecked I saw that if you have a CF card it does not even need the SuperGeeK.

The ideal solution for you, should be:
1. mini HyperDrive5
2. RiData 150X CF Card with Write Protection (e.g. 16GB)
3. 16GB of Ram for the mini hyperdrive

Install the OS. At the shutdown -> the data will be cloned to the CF -> take of the CF and enable the write protection. After that reincert it, unplug the battery and you are done.

Panagiotis

 

Will love to have it indeed.

 

All hardware requires a driver. The driver tells the operating system how to communicate with that hardware. Some common hardware, like keyboards and mice can use generic drivers which are built into Windows. But if the keyboard has special keys, then a special driver is required.

 

The thing with CoreRESTORE is that it doesn't need a driver. It has its own processor and is fully transparent to the computer. That makes it ideal for malware analysis as it is fully undetectable by malware and its Address Redirecting feature cannot be cirvumvented.

 

But where is this product? It does not seem to exist! Do you have a valid link to where one can be purchased today. And does it support CURRENT technologies - like SATA drives?

I would suggest there was a good reason it seems to have turned to vaporware 8 years ago - it didn't work as advertised.

 

Bill, I think you know all the answers to this.

It worked fine.

 

It isn't vaporware! There are reviews of it as can be read here:
http://books.google.co.uk/books?id=...store&pg=PA24#v=onepage&q=corerestore&f=false

But as a software solutions offers more options, these devices fell of the market.

They just didn't realize software can be compromised by malware, hardware like this can't. That's why I want it.

 

Adding to that as it in the article, deployment on a large scale meant more work and a lot more expense - 'hense less appealing.'

 

For large scale malware analysis it is ideal.

 

Then where is it? And I didn't say it didn't work. I said "...as advertised" And okay, maybe it did work, but so did BetaMax, and the Edsel. It may have technically worked but it did not suceed in the marketplace. Otherwise, it would still be available. I suspect it impacted drive performance too much, or just was not reliable. Or maybe the price of drives dropping made mirrored RAIDs too affordable.

Come on! That review is from 2002! It may have started out as a solid object, but it sure seems to have vaporized now. Show us something current.

And BTW, that review says it uses a PCI card therefore it uses a driver. It may be a generic bus driver that all operating systems have natively, but it's there.

So come on guys! We are talking about today! Show me something that says this is a viable solution for today's hardware and I'll admit I'm wrong. It won't be first, and I'm sure not the last time that will happen. I'm here to learn too.

 

It uses PCI for power and also so that it can display something right after BIOS post. It does not need a driver (see end of the article). It is OS independent.

As I said before, the same functionality is currently also available in SOFTWARE which is more convenient but less secure as you can read in this thread. The market just wanted a software solution (cheaper and more convenient). That's why CoreRestore and Voomtech's Instant Restore dropped of the market I guess.

I know these cards aren't available anymore, that is what this thread is all about

PS. If you say it is vaporware then I assumed you meant 'never existed'. Fact is though, it did exist. Sadly no longer...

 

Bill take a look at the start of the thread, I would like to replacement due to damage, trust me they work very well and I certainly would not do that if they didn't. Btw they are not out of date for me just because of SATA.

@erik any joy with contact and if not do you fancy this project

 

I just tried to call them but it seems that their phone number now belongs to a different company called Intelligent Solutions of San Diego.

See these two sites:
CoreRestore - http://cfs-llc.net/contact.htm
Intelligent Solutions - http://www.issandiego.com/contact.php

Same phone number, same address.

I'll try if I can find the guys who made the CoreRestore through LinkedIn.

 

Sure. And most of it works very well too. Even Windows native backup program backs up to a network connected storage device unattended with no problems. An old PC works great for that.

That's a fair statement.

 

If malware is a concern, then what's wrong with the recovery disk option included with so many image/restore programs like Acronis, ShadowProtect and Macrium, to name a few of the popular ones? It's quite simple to boot of the disk and restore a clean image kept on a separate - offline - storage like an external h/drive.

 

Backing up a bit, if malware is the concern, you need to re-assess your security defenses. While the security threat is very real, if you keep your systems patched and updated, you use a current "real-time" anti-malware program, and you avoid risky practices like participating in illegal filesharing or visiting illegal porn and gambling sites, malware should not be an issue. And I can easily say this because there are 100s of millions of users out there right now who run with default Windows settings (which includes auto update with Windows Update), Windows Firewall and perhaps MSE, and they remain clean with no problems.

I don't consider a backup program like this a necessity in the event of a malware infestation, I consider backups a necessity in the event of hardware failure.

Now of course there are exceptions. For example, if there are multiple users of your computer and some don't have the discipline to avoid risky practices, you may have problems.

To answer wat0114's question, the problem with image programs (all backup programs, actually) is that some malware sits dormant for days or even months until some event (or the badguy) triggers it. This means the image file could easily be infected too.

 

I don't need a CoreRestore-like device for one PC. I work for a security company and I need it to analyse 35.000+ files PER DAY. A restore from backup will take WAY too long. That's why a CoreRestore-like device is preferred.