Returnil

Not true ErikAlbert, plenty of the membership here hold a great deal of interest in your setup, especially me mainly because it's reason for great excitement and confidence to finally achieve that ultimate goal of totally locking down and away any chances no matter how remote, some potential for malicious forced encroachment into our machines.

I also don't discount in any way FD-ISR's FREEZE feature either, it's a fantastic technique IMHO that is a very beneficial & welcome feature of FD bar none. I just feel compelled to weigh ALL the differences and simply bring those comparisons to light for all to see.

 

ErikAlbert,
I apologize for missing your question earlier:

No, when protection is turned ON, all changes made to the %s will be lost with a reboot. If you save the object within the VP or on an alternate drive, then the object would be saved.

EASTER.2010 asked:

There is no connection other than the fact that I, like many others you may or may not know have worked at Lavasoft in the past. Before I worked for LS, I was also an outspoken antispyware and privacy advocate in the old Becky!2 forums. Part of my experience has been with technical, marketing, and PR text writing, so it is more than likely you have run into something I wrote somewhere...

wilbertnl asked:

Yes, Everyone here came together out of a sense of frustration with current/past security industry thinking and practice. We are concentrating on prevention, disk security, and disaster recovery technologies.

ErikAlbert asked:

While these numbers may not be of concern for you, there are others who do find these statistics useful. There are still more people that do not have the resources to afford the extra storage space and even more than that who have never used a backup drive or solution outside of XP system restore. Remember, to make choices, the user needs facts...

 

Very forthright and gracious reply ColdMoon and i do thank you for that. I wish the product all the luck and do hope that you intend to keep an interest in the concerns thats forthcoming regarding it.

EASTER

 

wilbertnl,
There are two distinct ways RVS will help you in testing software:

1) Virtual leaks - when using products like VMWare or MS there is a chance, no matter how small, that content can "leak" into your real system. RVS provides that last line of defense that will keep these leaks from making unintended changes to your real system partition.

I have seen this happen in a Malware research lab and it isn't pretty when a researcher looses valuable time recovering their system rather than testing the object of interest...

2) With just RVS alone there are limitations to testing software. This is only that if the program requires a reboot to complete its installation, that installation will fail because the changes were lost after reboot while the protection is ON. For those applications or components you wish to test that do NOT require a system reboot, then you can install and observe the system for issues before you decide to make a permanent installation without the need for using .ISO images or more advanced testing environments like VMWare.

For the researcher I believe that #1 has merit and value by adding a layer of protection against "accidents". For the consumer/end-user who does not understand the use of or how to set up a testing environment in VMWare, number 2 has merit and value for them.

Reason for edit: Forgot to spell check

 

OK. Back to the subject "Returnil".
If I'm wrong I beg you on my knee to correct me.
I didn't see any possibility to exclude objects in Returnil, which means that your total system partition is frozen. This would not be a problem for me, but for many other users.

Most computers have one harddisk and one system partition [C:] with everything on it, including DATA, normally stored under the folder "My Documents".
When Returnil protection is ON everything is frozen, including the folder "My Documents".

So when you are surfing on the internet, you can't do anything anymore.
You can't store an interesting website, you can't download, you can't write anything down.
This is unbearable and you will get sick and tired of this sooner or later.

To make Returnil comfortable, you need two partitions on your single harddisk :
1. System Pärtition [C:] = Windows + Returnil + Applications
2. Data Partition [D:] = personal files, downloaded files, bookmarks, emails, email-address-books, ...

Your system partition is protected by Returnil as much as possible, especially when on-line.
Your data partition makes it possible to UPDATE your data.

Do you need security softwares ? YES, even when Returnil Protection is ON.
Returnil only REMOVES all CHANGES 100% during reboot, including :
- infections of any kind (bad changes)
- Windows Update (good changes)
- updating of signatures of scanners (good changes)
- upgrades of all applications (good changes)

Returnil does NOT protect you against INSTALLATION/EXECUTION of malware.
That's why you need security software that stop installation and above all execution of malware.
You don't need security softwares to REMOVE malware, because Returnil takes care of that 100%.

How to keep the good changes is a problem, because you can only do this when :
1. Returnil Protection = OFF
2. Your computer is ON-LINE
Keep in mind that this is a problem for ALL similar softwares like Returnil.

How are you going to UPDATE without getting infected ?
Suggestions are welcome, because this is a general problem for softwares of this type.
Which procedure will you use to do updatings ?

 

I recognize that, Easter.
I may have found the right software and the perfect configuration, I allways have an interest in different options. Even more when it needs my attention to get it working right.

 

Hello ErikAlbert.

This is inaccurate, as the System Partition is not "frozen". You can do anything you want and there is no loss of experience while using RVS. System Protection is cloning the %s in memory and this is why all changes are lost after system reboot. So to be more accurate, please describe where the problem is for the normal user...

The "My Documents" folder is not "frozen" either. You can create documents and "save" them within this folder while you are in the session. The only difference is that if System Protection is ON, this data (documents, file, etc) will be lost with a reboot.

It is true that many systems do not have more than one partition. This is what the Virtual Partition was developed to solve for the user's benefit and convenience while using RVS with Protection ON. If you wish to make test saves of documents and data, then this is available. If you want to create and save the documents permanently, then the data should be saved within the Virtual Partition for those that lack an alternate partition or alternate drive.

Have you actually tested this assertion? There is no issue with surfing the internet and you can use any browser to go to any website as you would without using the System Protection. The protection feature does not freeze or cause the user to loose any functionality with their system whatsoever.

If you wish to save interesting web pages, download content and files, or even make notes, simply save them within the Virtual Partition like you would to your desktop. But an interesting thing to point out here is that saving data within your VP is more secure than saving to your system folders (desktop, My Documents, etc) as is the truth for saving data on alternate partitions.

This is exactly what you will have with RVS on a system with a single partition on their HDD:

1) System Partition [C:] = Windows + Returnil + Applications
2) Data Partition [Returnil Z:] = Personal files, downloaded files, bookmarks, e-mails, address book, etc

The only difference here is that if you set the VP as a default save location for your applications, you must ensure that the VP is mounted. This is not a great sacrifice in time or effort for the user, just change the appropriate data save location in the application you are using.

I would however recommend that the user consider creating an alternate data partition on their HDD. This is a widely accepted and recommended configuration for as long as I have been involved in security discussions - never install security programs in default directories, save your data on a non-system partition, etc

We believe strongly in an intelligent, layered approach to security. While in theory you could only use RVS protection, common sense, and good practice to remain infection free, even if something were to be executed (reboot the system and the changes are gone), it is not recommended for the average user. For example - RVS would not be useful to someone whose computer was already infected, as any removal efforts would be fruitless with a system reboot. Where RVS is essential is for the new computer or a clean system you want to keep that way.

The issue here is a misconception about what RVS is actually doing to protect your system. It is not freezing any folders or reducing the functionality of your system. It actually allows freedom to do whatever you want while making sure that unintended changes are not saved to your real system partition.

The object of our security technology is to ensure system integrity and to provide a line of defense to prevent infections from taking hold of your system.

Again, this is not true. First RVS does not require or use any form of network communications. It will not call home and has absolutely no reason to do so. RVS is client side software and will work whether you have an internet connection or not.

The first issue does have some truth to it, but in a limited way that is easily worked with. The most common issue is in regards to Antivirus and antimalware signature updates. For Antivirus and antimalware programs, you should reconfigure the program to download, save, and load their respective signature files from an alternate partition. This will allow your security program to update automatically as expected. For those without access to an alternate partition other than the RVS VP, then the save/load directory can be stored there. Just remember that if you choose the latter, you must ensure that the VP is mounted with Windows start.

The next issue is with Microsoft security updates. These come once a month, are announced well in advance of release, and can be installed at any time the user chooses. Therefore, it is not a large hurdle to deactivate RVS protection to allow the download and installation of these updates at the time convenient to you.

What is more interesting here is that even if you miss time this and do not get the update, your system is protected against unwanted changes that might exploit what these updates were developed to address.

---
Mike

 

What is the point of adding and editing data files, if the Protection = ON. Everything is GONE after reboot. Who is going to be happy with working for NOTHING ?
If Returnil doesn't accept any change after reboot, that's the same as a frozen state.

Explain me one thing :
A user is surfing for a long period on the internet and he finds an interestng website.
He adds the website to his bookmarks of his browser and wants to keep it.
How is he going to keep that bookmark in his browser, without turning protection OFF ?
If Protection = OFF, how is he going to save that single bookmark.
Saving the whole harddisk ? What about the malware that infected his harddisk during surfing ? Are you going to save these malwares too ?
Just describe me the procedure, what a user has to do, to keep that bookmark without saving the whole possible infected harddisk.

 

ErikAlbert, Does my memory serve me right and are you using Mozilla Firefox?
Where it concerns Firefox, none of my computers has any bookmark stored at all.
I'm using Del.icio.us Bookmarks, which enables me to store each and every bookmark on their website (not shared).



You should give it s swirl, it adds search features to your bookmarks.

Anyway, the point is that you can make Returnil work in a way that you are comfortable with. I know that you have made changes to your configuration and user habits to make things work the way you want. Would you not agree?
And if software doesn't appeal to you, that is fine too.

 

One very good example is when you want to test alternate program configurations. This allows you to make the changes and then observe the result as long as the change does not include a requirement for a system reboot to apply.

I would say that this is time well spent, rather than having to endure the frustration of a configurations error that causes more issues. Once satisfied with the changes, make them premanent by turning OFF protection and then saving your configurations as part of your base setup.

We need to be careful of our language here as the word "freeze" implies an inaccurate picture for an inexperienced user. Again, it is important to understand that there is no limitation on what you can do, create, or save.

The limit comes where "PERMANENT" change is concerned. Changes are made continuously to the cloned copy of your System Partition in memory, so the user will see and experience exactly what they expect to see and experience. And for most users, who spend little to no time changing their program settings, this distinction is a moot issue. RVS was designed to allow the user to have a full computing experience without worrying that harmful changes would be made to their real system partition while using the protection feature.

Ok, the least intrusive way to do this would be to export and import bookmark files. If you want to save an interesting site in bookmarks then do so as you normally would and then export the bookmarks file to an alternate drive or within your VP.

Simply import the file to use during your current session while protection is ON and then decide if you want to make it a permanent addition to your basic bookmark list. To do so, export your bookmark file to your VP and then turn Protection OFF. Now reboot and then import the updated bookmark file, then turn Protection back ON to return to your normal computing day.

By doing as I suggested, there would be no issue with infection as any change caused by malicious content would be lost after reboot and before you made the permanent import update to your bookmarks. and if you are only using custom imported bookmark files from your VP, then the content that may have been infected in the browser cache will be gone after a reboot as expected.

There is absolutely no reason to save the entire contents of the HDD outside of a normal system backup or recovery image. As RVS does not allow changes to be made to the real System Partition with Protection ON, there is no need to carry extra baggage in the form of an image except as noted above or in a full blown testing environment which testing software like VMWare handles quite well.

WARNING! the following information is not recommended for inexperienced users! If you do not completely understand the potential consequences involved with moving system folders, DO NOT DO THIS!

NOTE: This utility is currently designed for those who want to make the move permanent as part of their use of RVS System Protection

As part of our development program we create a number of concept and testing programs that are designed to explore solutions internally without making changes to the main program. In this specific case we created a utility that would allow the user to move some System Folders to an alternate partition including the VP called RVSMOVER and is included in the RVS installation.

The utility can be found in the (default) "C:\Program Files\Returnil" directory. See attached JPEG for a picture of the main screen.

This utility was designed to allow an option for experienced users who want to move their Desktop, IE Favorites, and IE Cookie system folders to an alternate drive.

I strongly caution the user that this is not a trivial thing to just experiment with! Again, if in doubt, stay clear... We also recommend that if you are an experienced user who is familiar with this type of configuration that you should choose an alternate partition on your existing HDD (example: Data partition D:\) to minimize any potential issues you might experience.

When moving system folders it is essential that the target directory/partition be one that will boot with Windows! Though the VP is a valid target directory we would caution that this is not recommended as you may decide in the future that you no longer want to use RVS and mounting of the VP is dependent on having RVS installed.

 

Coldmoon,
Now I understand how it works. I knew there had to be more than just a VP, but I couldn't figure out what.
Many thanks for the explanation and it will be usefull for other members, who might be interested in Returnil.

 

.

As you see where i have HighLighted in blue repeated references to saving to alternative second HD's/Partitions if a user wants to keep anything. This is exactly the same procedure i been using all along with Power Shadow since a reboot flushes away the shadowed/virtual session containing ANY changes save the command for the program to Exit shadow-mode.

Please explain what if anything is so very different or beneficial with Returnil since when using this type of Virtualization with protection= "ON" the user is effectively Locked away from saving anything unless you disable protection OR move it to an alternate partition/drive/USB Flash etc. At least that's the suggestions i read into it from the above replies so far.

Thanks, and i look forward to understanding what these differences are exactly and what Returnil offers over equal type of virtualization programs.

 

Thanks Peter2150 I suspected as much but....

You simply just can't help but notice the obvious similarities there and that's why reviewing very close every description offered about it's functions demands looking for some distinct differences/benefits or anything else we might be missing here.

 

Isn't trial 30days 15days? Mine has ran out after a couple of days.

 

Thanks for the tip. Now bookmarks was just an example to ask Coldmoon how Returnil really works in practice. I could have given another example, but bookmarks crossed my mind when I was writing my post. I don't have a problem with bookmarks on my computer, because I have split Firefox over my system and data partition and my bookmarks are stored on my data partition. For the moment I try to use as less softwares as possible until I have what I really want.
The problem with such softwares, like FDISR, Deepfreeze, Returnil, ... is that you have to keep some changes, even when the frozen state doesn't allow PERMANENT changes.

Another and even bigger problem is keeping the VP of Returnil 100% MALWARE-FREE. Each time you UPDATE that VP, you run that risk. I have the same problem with my Freeze Storage or rollback snapshot or archived snapshot. Once it is infected your dream becomes a nightmare, sometimes without even knowing it.

Nevertheless, I will see how your bookmark solution can be a benefit for me too, because I consider Firefox on my data partition as a pain in my ....

 

Hello,
I apologize for the late reply and thank you for the great questions. I was battling through a late season Flu so will do my best to cover everything to date (warning – long post ahead)

ErikAlbert said:

I am glad I could help. I have been away from active participation in the Wilder’s community for a long time (before the original move) due to overwhelming duties elsewhere. It is good to be back…

EASTER.2010 said:

First, using non-system partitions to save data is just prudent security practice. I am sure you and I can agree on this fact at least. As both of us have come from the Antispyware side, we know that malicious content will target the %s by necessity rather than by simple choice.

This by no means implies that this is the end-all to security practice, but it is more secure than saving data on the actual system partition. Moreover, it is no more difficult for the user to choose an alternate partition as a target save location then it is to use the default save location designed into Windows.

I am not aware that this advice has changed in any substantive way from when it was first discussed back in the late 1990’s – early 2000’s. The objective is to keep unwanted changes from occurring, but also to get potentially malicious content as far away from the system partition as possible without loosing computing convenience.

The differences are made a bit clearer below in reply to the additional postings made by other participants.

Peter2150 said:

And Easter.2010 said in reply:

We must make a distinction between two important concepts:
1) Effect and
2) Function

In effect, what RVS is designed to do is similar to what PS and others are designed to do, that is, preventing unwanted/malicious changes to the system partition. Where the difference is, is in function – how the unwanted/malicious content is kept from making those changes.

The most important difference is in the method used to secure the System Partition from said changes. PS and others use a method we explored early on and ultimately rejected due to issues with un-even disk wear because they use a dedicated disk buffer to store and update changes made while using their protection feature. While this may not seem to be a large issue, we should explore the consequences of this type of solution.

Unnecessary hardware use:

Let us assume for the moment that the user has a HDD of 40 gigs. Further, let us assume that the PS protection feature sets aside 10 gigs of buffer to keep track of “changes” made during the applicable protection session. IF we further assume that the user decides to use the protection feature 100% of the time, “changes” will only happen on 10 of 40 gigs within the HDD or 25% of the HDD in question.

A good analogy here is to think of what happens to your favorite pair of Blue Jeans over time. As time goes by, you find that while the pants still look good (assuming you are diligent about proper washing and avoid the occasional snag) the knees begin to fade and eventually wear through. This is similar to what occurs over time with dedicated and limited disk use – you wear through that section faster than you do the rest of the disk.

RVS uses memory to clone the system partition so if the user chooses to run with protection always ON, the HDD experiences no wear so will last longer. In function, RVS preserves DISK health better than other similar products over time.

Speed of clone updating:

All HDD’s are limited by their speed. Even if you are using a faster 7,500 or 10,000 RPM HDD, you are limited as to how quickly you can access the dedicated buffer and further by how quickly you can “save” those changes within the buffer.

RVS uses memory so updates happen at a much faster rate. Think of how your system would perform with a Flash HDD rather than a traditional mechanical HDD and you begin to see why the technology in RVS can improve system performance and reduce component wear…

Meriadoc asked:

We use a 15 day trial period for the full version. To address this during the beta testing period, we are offering free, 30-day license keys that can be obtained by e-mail request: betatest@returnilsoftware.com

For those who provide the best feedback we are also offering free one year license keys as a thank you from us for their assistance in improving RVS.

There will also be additional choices we will announce as soon as 1.62 has reached its final release and before we begin the next series of public product betas. This may or may not include new applications and technology outside of RVS. As mentioned in an earlier reply, we want a focused mission but not an exclusive solution/product. IOW, we will have other solutions targeted towards additional aspects of Disk protection and disaster recovery.

Peter2150 asked:

First, I must state that I am not a network or Raid expert by any stretch of the imagination, so am limiting my discussion to a direct answer to Peter.

For the reader who is not familiar with RAID, a good place to start would be here:
http://en.wikipedia.org/wiki/RAID

It is my understanding that in RAID 0, changes occur simultaneously to two or more redundant HDD’s to improve bandwidth performance and as a result will make data and drive access much faster than with a single drive. Moreover, Windows will see all drives within RAID 0 arrays as a single HDD. IOW, when saving data you save a portion of the data on each drive separately: EX saving “I Like you” would have “I” saved on disk 1, “Like” saved on disk 2, and “you” saved on disk 3.

This will improve system performance but it does not assure disk protection or disaster recovery as a failure or error in any one of the RAID 0 drives will result in the same failure or error on the other drives in the array.

If we revisit my reply above to potential issues with the dedicated buffer solution, RVS becomes even more appropriate as changes take place in memory, so with protection ON, RVS actually provides protection that will minimize or eliminate failures on the real HDD’s in the array.

ErikAlbert said:

This “saving” is temporary and in the case of RVS is limited to the clone in memory. So, unlike the other solutions mentioned, does not make any changes to the real HDD to do this. IOW, even this temporary saving will not touch or make any changes to the real HDD.

ErikAlbert also said:

True, if you save malicious content in any form you run a risk of activating that content. Where this misses the mark is in what could happen if that content is activated while using RVS or other solutions in this space.

If you save Malware within the VP, you still have protection and choice with RVS. First, let us assume that you have saved the “OHSONASTY” Trojan within the VP. Even if you accidentally activate this content from within the VP, if you are using RVS System Protection, this content installation will fail with a system reboot. Just because you use RVS, PS, SU, DF, etc, does not negate the requirement for intelligent layering. Regardless of what AV/AM solution you prefer, Virtual protection gives you that last defense against the malicious content becoming a permanent “guest” and offers precious time to locate and eradicate the content before it can make changes that can take outrageous amounts of time to fix without this type of protection.

Further, your preferred AV/AM will see the VP as just another HDD partition. Therefore, if the VP is mounted you can scan and “clean” its contents as you would any other partition on your system (see-attached image)

 

Interesting and welcomed differences you mean to point out Coldmoon. Very distinct & beneficial differences are at the heart of what attracts attention enough to make any new product stand out in the mind of users and of course potential customers.

Indeed. And as you are so apt to have pointed out, and i thank you for that, we BOTH are long very well acquainted in AntiMalware circles and have seen our fair compliment of plenty of techniques and material which been cleverly fashioned to make the most of disrupting normal PC machine operations, from adversely affecting simple PC features to the more extreme designs determined to form maximum to irrepairable damage leading to a complete reinstall to that end. A very bitter ordeal for those on the receiving end of them.

If you could expound further on one chief difference you make very clear of the concept employed by Returnil.
It's to do with MEMORY vs. DISK. You already drawed clear lines between the two and frankly it does appear to contain beneficial merit. But i think it would help other readers of this thread, including myself, to have a better understanding of just what accessing MEMORY involves as to space compared to physical disk (buffer). For some of us not exactly privy to the structure of what all MEMORY per say entails, it will prove useful for many of us to be able to draw a mental picture of just how MEMORY is best utilized for the purpose of this type of Virtualization. What are it's weaknesses? Are you speaking of Virtual Memory alone?

I think most will agree that any means to preserve and prolong the life of any hardware within their respective systems is of a paramount concern for them. Not only this but you do bring up yet another important fact about performance, MEMORY is quicker then having to make use of Read-Write Access Heads in the HD itself which of course overtime can tax those physical componants.

Thanks

 

Hello Peter,

My argument is a thought experiment to explore the extreme where disk wear is concerned. This is why I was very careful to list my assumptions in support of the argument, not to establish or publish any statistical testing data.

I agree that it would not only be valid, but welcomed for an independent testing authority to do exactly as you suggest. At the very least, I sincerely hope that community discussions like this will help to push more discussion and comparative testing that includes the technologies discussed here rather than just testing the traditional applications (the usual suspects as it were…)

IFO distrust any participant sponsored test as they are inevitably skewed towards the company that paid for the test. Sadly, this has not changed from the early days…

There are two important recommendations we stress to allow proper and efficient use of RVS:

1) Make sure your system is clean! RVS or any other product in this space will not help you if your system is already infected!

2) Before you install RVS, defrag your HDD. This will provide the most efficient environment for RVS and further, will make your system faster because the HDD will remain defragged with System protection ON

Therefore, logically and practically if the user runs with protection on all the time, the disk will not need defragmentation. Again, this is a discussion of the extreme, but also goes towards showing the reader that they will have significanltly less need for HDD defragging...

Easter.2010 asked:

RVS clones your system partition in memory, that is, it makes this clone within your system's phisical memory. The size of your real HDD system partition is irrelevant except to note that you will have better performance with more installed memory.

Even in a minimal system configuration, RVS will provide some performance enhancement BECAUSE it uses memory rather than disk read/write access to store the clone. Even if you are using a "stress test" line up of open applications, you are still physically limited by the number of simultaneous changes you can realistically make to the applications so it is very unlikely you will ever get to a point where the clone cannot be updated in response to your activities. Further, it is also more likely that you will encounter performance issues (with this extreme situation) that are related to your system's processing limitations (CPU doing overtime) than due to any issues where the clone updating is concerned.

The best advice I can give here would be for the user to test everything we have discussed to make their own decision. And as a result also join the debate - it can only make all of our solutions better...

 

Peter,
My argument was based on further assumptions that should be spelled out (given your reply), but did not include them so I could cover the main point. Please forgive this oversight in my previous reply.

Assumptions:

1) The user has a static environment and chooses not to make any changes to their real System Partition. This is only to reduce the variables to a manageable level. If we are to discuss HDD wear only, we must eliminate other potential contributing factors. This would be a standard prerequisite to actual lab testing: Identical computers, from the same manufacturer, with exactly the same software/hardware installed, etc…

2) The numbers I discussed are theoretical not statistical to provide an easily understood picture for the user. Actual clone dimensions, where they are stored and updated, and the underlying technology will of course differ depending on the particular solution tested. This in no way however removes the validity of the argument itself – if you don’t access the HDD, then you will not cause additional wear due to use other than the access required to boot the system and then to login to your user account.

3) The average life expectancy for most mechanical HDD’s is 3 to 5 years. However, this can be debated up or down depending on the record of accomplishment of your HDD manufacturer, this helps us to define the real-world testing time required to collect the relevant empirical data that would be needed to provide the level of accuracy your reply demands.

My argument then attempts to highlight a LOGICAL conclusion of what to expect over a long period of time (that same 3 to 5 year period). As there is no possibility that I or anyone here at Returnil Studios can go back in time with copies of our current and competitor’s products with identical systems as described above, it would be impossible for anyone to provide 3 to 5 years of empirical comparative data to analyze.

So where does that leave this debate? I have proposed a hypothetical argument that attempts provide a qualitative, as opposed to quantitative analysis of the available data and where that data will lead logically.

If you find fault in the logic and the subsequent conclusions, IFO would like to see your counter-argument based on the same assumptions…

 

I love Kierkegaard.

 

Hello benny bronx,
This is not about a "leap of faith". The assumptions I used are valid for a qualitative analysis given the appropriate restrictions as noted. It might help if you were to expand on your statement so I could provide a more detailed reply...