Upcomint Returnil Snapshot Feature and Imaging

Mike,
Hope this is right forum to post this but you mentioned that Returnil would have in 3.2 version snapshot technology to go back to an earlier state in time if needed. Sounds great but how will these snapshots interact with imaging software like ShadowProtect - will we be able to make images of the system partition that will still retain Returnil snapshots on resotre of image? Thanks.

Gary

 

Hi Gary,
The RMSE will be able to do the following:

1. Restore malware damaged, corrupted, or missing system files from any appropriate source (Windows installation disks, factory restore images, and Returnil snapshots)

2. Snapshots can be created automatically (every hour) or manually

3. Allow recovery of missing files from an existing snapshot. You restore to snapshot "A", but it does not contain the WORD document you had in snapshot "b" for example.

4. Allow snapshots to be stored/backed up for compliance or troubleshooting purposes

Regarding compatibility with other imaging solutions I can not say specifically as the feature is still under development. It does however take advantage of virtualization technology we have developed for RVS itself, so there may or may not be issues as there are currently when attempting to use RVS at the same time as ATI for example.

Creating snapshots is incredibly fast and is done without any perceptible overhead. Restoring to a chosen snapshot can be accomplished with a couple of mouse clicks and a restart of the computer (restoration may take time depending on the size and number of changes between the existing system and the one stored in the snapshot).

Mike

 

Quote Coldmoon

I can confirm that when i tested a BETA I thought there must have been an error as it only took about 2 seconds But no, when i challenged this i was informed it's correct

I didn't test a snapshot restore, so can't comment on that aspect.

Looking forward to the final release

 

will these features be in the free version of RVS?

also is the snapshot feature supposed to be as a feature close to continuing shadow sessions after boot?

 

Hi Serapis,
The multi-state restore engine will be a premium feature so will not be available in the freeware version.

Yes, but in so far as it will allow the testing of new programs by allowing restoration to a given snapshot to support testing across restarts of the computer.

Mike

 

Any idea when this feature will be in the latest Returnil?

 

You should begin seeing it implemented in the 3.2 series. This may not be all features proposed so also look for improvements additions to be made as we go forward.

Mike

 

Hi Mike, does RS have a hotkey to bring up an option to restore at boot. Read through the manual and didn't see one or maybe I missed it?

Have tested RS against a few nasties and it seems to work fine in restoring to a clean state but against one sample which constantly reboots the machine and disables safemode etc a hot key would of made things easier.

Had to boot from a live cd and delete the malware manually to get back into windows for a snapshot restore.

XP VM.

 

Hi Franklin,

No, this is not an included feature. The focus right now is to integrate the features in an upcoming version of RSS so what you see now is directly related to it "fitting" in to the overall RSS scheme where:

1. The malware would be blocked
2. The malware would be detected and quarantined
3. If 1 and 2 fail, then restore specific files using the file recovery
4. If 1, 2, and 3 fail, then restore to a full snapshot

#3 is dependent on having performed at least one full restore in the past where known clean files can be obtained with the VG giving you a reasonable certainty as to which snapshots you have are found clean via malware scan.

It would be useful however to understand the malware you tested and what it did to cause the restore issue you ran into. To this end, could you shoot us a note to our support address with a copy of the malware (in password protected ZIP or RAR) and a full description of the steps that will allow us to reproduce your test in the lab?

Thanks
Mike

 

Malware sample emailed to tech support.