From the FAQs on the Toolwiz website, TTF does work in much the same way as SD. When they say that TTF creates a virtual environment as a copy of the real system, what they mean is that the virtual environment is derived from the real system, so in that sense can be regarded as a copy of it. Nothing in the real system has been physically copied to create the virtual environment though. Only changes to the real system are recorded in the virtualization cache as they occur. The virtual environment is a logical construct, derived by merging the original disk sectors and the changes recorded in the virtualization cache to create the illusion of a file system and registry that is changing. Upon reboot, the virtualization cache containing the changes is discarded and the system remains in its original state prior to entering the virtual environment. Nothing is physically restored, because nothing ever really changed. http://www.toolwiz.com/en/products/toolwiz-time-freeze/faqs/ Sandboxie is similar to the extent that file system and registry writes are redirected in order to isolate sandboxed applications and prevent them from changing the real system. The difference is that, whereas SD and TTF work at the disk sector level to virtualize an entire volume(s), Sandboxie works at the file system level to contain all file system and registry changes within the sandbox container folder for applications running inside the sandbox.