Toolwiz Time Freeze

Discussion in 'sandboxing & virtualization' started by sg09, Dec 1, 2011.

  1. RollingThunder

    RollingThunder Registered Member

    Joined:
    Nov 21, 2013
    Posts:
    224
    Location:
    USA
    Can I get a comparison between ToolWiz Time Freeze and Shadow Defender please?
     
    Last edited: Feb 1, 2014
  2. HAN

    HAN Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    2,098
    Location:
    USA
    I can't remember seeing in the posts I've read... does TTF run fine under a Windows 7/8 standard/limited user account? I'm just so used to doing most everything under my standard user account and I would like to continue to do so if I run TTF in the near future.
     
  3. Zapco_force

    Zapco_force Registered Member

    Joined:
    May 17, 2013
    Posts:
    88
    Location:
    Italy
    Good evening to all,
    I'm trying the new version of TTF (v. 2.2.0.3500) but I found that the cache folder created by the program, take up space unnecessarily even if TTF is not active. :mad:
    While with version 2.1 the cache folder was always empty, and the space was occupied in the "freeze" mode ONLY...

    Know you a way to fix this "problem"??
     
  4. CGuard

    CGuard Registered Member

    Joined:
    Mar 2, 2012
    Posts:
    145
    @bo elam:

    We are on the same page. The multipurposed nature of LV software (coupled with an anti-execution/software restriction strategy) is too valuable to my security approach, to let occasional bugs and issues steer me away from it.

    BTW, i 've just e-mailed James regarding the previously mentioned "issues".

    @RollingThunder:

    Based on my experience with the (old, but popular) .325* version of SD and the old/new TTF, i would say that their main differences are:

    1. that SD can protect any partition, while TTF protects only the system partition

    2. that TTF is ligher on resources, while SD is heavier

    3. that TTF runs at a Medium Integrity Level, while SD ran(/runs?) at a High IL

    4. that SD gives you the chance to "Commit Now" any changed file/folder that you want while in Shadow Mode, unlike the new** TTF which doesn't support such operation (come to think of it, maybe the "togglablity" of TTF's Folder Exclusion serves as a way to pre-"Commit Now"-on-demand -just guessing, here...)

    * The .325 is a 4 years old version. Newer versions come with "RAM as Cache", "Registry Exclusion" and other features. Perhaps, a user with an up-to-date experience on SD can -well- update this list of differences. Even better, you can try for yourself both products and see which one best suits your needs. Personally, even though i own a giveaway lisence of the rich-featured SD, i prefer to put my system in "Frozen Mode", not in "Shadow Mode". In my opinion, TTF is a simple, effective and light LV solution, perfect for a layered security approach.

    **The old engine of TTF has the ability to commit all the changes that take place during a frozen session to the real system, upon shutdown/reboot -never tried it, though.

    One last thing: i don't know how each product realizes the light virtualization effect, but i believe that each one uses its own way. Maybe, a more knowledgealbe user can enlighten both of us.

    @HAN:

    The old engine of TTF works flawlessly under a SUA. I don't know if that holds for the new engine also, since i haven't had the time to test it.
     
  5. Robin A.

    Robin A. Registered Member

    Joined:
    Feb 25, 2006
    Posts:
    2,557
    It´s not clear to me if SD can protect all partitions in an UEFI system. In my case, version 1.3.0.457 only shows as available for protection the "non-system" NTFS partitions and the OS (C: ) partition. The other four UEFI "system partitions" and the OEM diagnostics partition are not shown. I don´t know if they are always protected, or just can´t be protected.
     
  6. The Shadow

    The Shadow Registered Member

    Joined:
    Jan 24, 2012
    Posts:
    814
    Location:
    USA
    At present, SD can 'only' protect volumes with an assigned letter, but I'm pretty sure that the ability to place the disk's entire 1st track in Shadow Mode is in development.

    TS
     
  7. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    I did a test to see what happens when the cache is full with v2.2.0.3500. The tray icon warns when the cache is getting full. When it got full, Windows became unresponsive. I turned off the computer. When I rebooted, the changes I made were gone :thumb:.
     
  8. Zapco_force

    Zapco_force Registered Member

    Joined:
    May 17, 2013
    Posts:
    88
    Location:
    Italy

    Why nobody talks about it?? :blink:

    Honestly I don't like that cache folder occupies always the allocated space, even if the "freeze" mode is not active :rolleyes: ....for me It's a non-sense! :thumbd:

    if there is no way to change size of cache folder, I will return to the "old" version 2.1!!...;)
     
  9. majoMo

    majoMo Registered Member

    Joined:
    Aug 31, 2007
    Posts:
    994
    I'm using oldest 1.9.3 yet... :shifty:

    When I tried the newest v. 2.2 I decided to stay with the old version. Against new 2.2. versions:

    ♦ 2.2. version hasn’t File Locker feature that I use in some D:\ partition folders;
    ♦ Cache Size can’t be changed inside GUI;
    ♦ ‘Show floating toolbar on desktop’ feature go away in 2.2;
    ♦ Can’t hide TTF tray icon that could be useful sometimes.

    Exclude Folder was added. Good, but unneeded to me, since I did junctions to my data partition (to ‘My Documents’, programs data profiles like to Maxthon, AdFender, Spamhilator, Thunderbird, PicaJet, etc.).

    :cool:
     
  10. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    Last edited: Feb 7, 2014
  11. majoMo

    majoMo Registered Member

    Joined:
    Aug 31, 2007
    Posts:
    994
    @ MrBrian, it is in their Page also (search by 'Download Old Version.')
     
  12. Zapco_force

    Zapco_force Registered Member

    Joined:
    May 17, 2013
    Posts:
    88
    Location:
    Italy
    Thanks for the quick response MajoMo :)

    Well...I'll do the same thing!

    The new version 2.2 has an faster engine, but I think that still too many bugs also, and must be corrected by developer

    However, do you think that the previous versions (2.1 or 2.0 or 1.9) work fine on Windows7-Pro SP1 (64bit)?
     
  13. CGuard

    CGuard Registered Member

    Joined:
    Mar 2, 2012
    Posts:
    145
    Hi majoMo,

    1) I was also missing the "File Locker" module that came along with the old engine, but, luckily, i found -the more configurable and complete- Easy File Locker (developed by SD's Tony, i believe) to couple TTF with it. One interesting feature of EFL, that TTF's FL is lacking of, is the ability to toggle protection status per file/folder -that is, besides its master on/off "switch". Sadly, there is not a visual indication for the "per location" protection toggling.

    2) I totally agree on that.

    3) Since 2.2.0.3000, there is an option to show the toolbar on desktop.
     
  14. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    (Apologies if this has been discussed already; it's a long thread.)

    I have made a discovery! Using 2.2.0.3500 on Win 7 x64, I deleted its cache file, but Toolwiz Time Freeze still seems to work fine, and retains its functionality :D!

    I tested if a new cache file is created by doing before-and-after file system snapshots with both System Explorer and Regshot; I found none. What apparently happens is that without a cache file, when protection is on the file system's free sectors are used as the cache :D.

    If the above is accurate, then why is a cache file normally used? Maybe this is some capability that's not been exposed to the user yet but will be in the future (or was in the past?).

    I tested this in a virtual machine. Use at your own risk.
     
  15. majoMo

    majoMo Registered Member

    Joined:
    Aug 31, 2007
    Posts:
    994
    Yes they work without annoyances in Win 7 SP1 x64 systems.
    You are right about. But I'm talking about 'floating toolbar in desktop' that is useful and least intrusive to users.
    BTW, I'm aware 'Easy File Locker ' from SD'developer that is easy-to-use and reliable - just now I'm using 'idoo File Encryption' also that allows me other useful options.
    In old engine file cache is always locked [kernel level] and doesn't allows to be deleted (at least in a normal remove process). Can you remove it using the Windows delete feature? Or you need to do that with windows someway off?
    I think it is used to redirect all changes that user do when working in their system only. In old engine that allowed a user to have a chance to 'to save the changes to your real system' on the fly - that is not allowed in the newest version/engine.
     
  16. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    I deleted it in Windows Explorer, but Toolwiz Time Freeze protection seemed to work anyway! In one of my tests with protection on, I filled a 18 GB free space partition with around 17 GB of new files; those files were gone upon reboot.
     
  17. majoMo

    majoMo Registered Member

    Joined:
    Aug 31, 2007
    Posts:
    994
    Good to know that. TTF is a solid light virtualization application indeed.

    :shifty:
     
  18. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    I installed v2.2.0.3500 on a non-virtual Windows 7 x64 system, and deleted the cache file. It works fine for me so far :thumb:.
     
  19. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    I'd think that using free clusters is a superior way of doing the caching. The only bad thing I can think of is that doing so makes it less likely to be able to recover overwritten deleted files.
     
  20. Zapco_force

    Zapco_force Registered Member

    Joined:
    May 17, 2013
    Posts:
    88
    Location:
    Italy
    Good evening to all, I have another small question about TTF:

    Is TTF enough robust for also to test programs that are installed very "deep", like the antiviruses??....Can we be sure
    that any track disappears anyway?
     
  21. majoMo

    majoMo Registered Member

    Joined:
    Aug 31, 2007
    Posts:
    994
    @ Zapco_force, Since, in general, AV software needs/request the System to reboot to finalize their installation, you can't try e.g. the installed AV several times after reboot to test it, when using TTF. This is the downside when using TTF to test an app. that needs to reboot; however you can "be sure
    that any track disappears anyway" when TTF is used.

    When I want to test an app. that request/demand to reboot the System, I use 'Toolwiz Time Machine' that revert your PC to the state it was before installing the e.g. AV and with the snapshot done before AV installed.

    :cool:
     
  22. taleblou

    taleblou Registered Member

    Joined:
    Jan 9, 2010
    Posts:
    1,349
    Well there are test videos in youtube that date back a while by a guy that tsted all sandboxes and virtualization systems like shadow defender and time freeze against bad tdss and boot and mbr infecting malwares, etc.. I suggest you search for it in youtube. From what I saw shadow defender failed one of the malwares and passed all other while time freeze also failed one malwares. It seemed the infection that shaodw defender failed was blocked by time freeze, while the one time freeze failed was blocked by shadow defender.

    These were of the older version of both apps and video was a couple years old.
     
  23. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    Anybody else deleted the cache file?
     
  24. CGuard

    CGuard Registered Member

    Joined:
    Mar 2, 2012
    Posts:
    145
    Yes. (W7 Ultimate, x86)

    1. Cache File deleted -> Frozen Mode started: TTF works without any noticeable issue, but rebooting after a "frozen" session takes longer time (the "Welcome" screen is coming up delayed). Maybe that delay is explained by your free-clusters-as-cache theory.

    2. Frozen Mode started -> Cache File force-deleted: TTF works without any noticeable issue. After rebooting, the cache file is normaly showing up where it is supposed to be.

    Interesting discovery!

    Maybe James should enlighten us.

    [On a semi-related note, it has been 8 days since i emailed him (and 3 days since i resent him my email from a different account) and i have yet to receive his responding email. I know that he is usually responding pretty fast. Also, there is no sign of him in toolwiz forum. I am quite worried. Hope he is ok.]
     
  25. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
    I didn't notice any slowdown here (Win 7 x64) upon reboot, but maybe I wasn't looking too closely.

    This had to have been programmed on purpose. I'm guessing the option to not use a cache file will be exposed in the user interface in an upcoming release, provided that it's not buggy (I haven't noticed any bugs in my limited usage).
     
    Last edited: Feb 13, 2014
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.