Returnil and Eraser

Discussion in 'sandboxing & virtualization' started by HURST, Jul 10, 2008.

Thread Status:
Not open for further replies.
  1. HURST

    HURST Registered Member

    Joined:
    Jul 20, 2007
    Posts:
    1,419
    Not sure if this is the right forum for this question.

    If Returnil is enabled, are 3 (or 7 or 35) passes actually needed?

    I mean: with returnil enabled, I download a file, and then decide to delete it. Would the multi-pass erasing be undone by returnil when I reboot my PC? Would it be better just to normally delete it or just leave it there so that Returnil deletes it upon reboot?
     
  2. Threedog

    Threedog Registered Member

    Joined:
    Mar 20, 2005
    Posts:
    1,125
    Location:
    Nova Scotia, Canada
    I think it would depend on whether you are using disc cache or memory. If you are using it in memory mode then all traces would be gone with a reboot as nothing actually gets written to the disc. I am not certain what happens if you have disc cache enabled.
     
  3. testerazzi

    testerazzi Registered Member

    Joined:
    Jun 13, 2008
    Posts:
    21
    Returnil write to the disc also in memory cache (it hooks kernel objects)
     
  4. tradetime

    tradetime Registered Member

    Joined:
    Oct 24, 2006
    Posts:
    1,000
    Location:
    UK
    Hadn't seen this question before, but I'd be interested to see what Coldmoon has to say on this as I have often wondered.
    If you have a file on your computer already, and you enable Returnil and Erase said file, when you reboot said file will still be there as Returnil has prevented the erase, possibly by intercepting the erase and sending it to empty space. But, if you create a file in a Returnil session, it will of course not be there on reboot, so in this case will Returnil allow it to be erased, ie does Returnil only act when a file is targeted that should be protected, or does it simply always interupt the erasing process regardless if the target file should be protected or not.
     
Thread Status:
Not open for further replies.