virtual os or returnil

Discussion in 'sandboxing & virtualization' started by owen35ny, May 31, 2013.

Thread Status:
Not open for further replies.
  1. owen35ny

    owen35ny Registered Member

    Joined:
    Nov 11, 2008
    Posts:
    28
    If you use returnil or if you virtualize your entire operating system with some other software, does that mean that NOTHING would actually be written to your hard drive? I
     
  2. Robin A.

    Robin A. Registered Member

    Joined:
    Feb 25, 2006
    Posts:
    2,285
    The short answer is no. If you use a light virtualizer with that expectation, sooner or later you will be disappointed.
     
  3. andyman35

    andyman35 Registered Member

    Joined:
    Nov 2, 2007
    Posts:
    2,336
    A virtual operating system still writes to your hard drive,it's just that it's an isolated area of the disk.Running a "live" cd O/S is the only way to accomplish what you ask.
     
  4. pegr

    pegr Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    2,279
    Location:
    UK
    Shadow Defender has an option to create the virtualization cache in RAM, instead of writing the redirected sectors to the disk.
     
  5. culla

    culla Registered Member

    Joined:
    Aug 15, 2005
    Posts:
    504
    so does returnil2008 which i'm still using
     
  6. andyman35

    andyman35 Registered Member

    Joined:
    Nov 2, 2007
    Posts:
    2,336
    That was the best version of Returnil IMO,before the addition of the AV.
     
  7. Robin A.

    Robin A. Registered Member

    Joined:
    Feb 25, 2006
    Posts:
    2,285
    Even it the cache is kept in RAM, SD can write to the "real disk". For example, virtualize the active partition and modify the BCD. You will find that the changes remain after rebooting. Or simply change the SD configuration, the same happens.
     
  8. ichito

    ichito Registered Member

    Joined:
    Jan 14, 2011
    Posts:
    1,486
    Location:
    Poland - Cracow
    Thanks guys for reminder of RVS 2008...I still have it in my archive so there was no way not to install and try it at once :) I'm surpised and impressed how functionaly and useful was RVS in that version...anti-exe, whitelisting, lock-mode, RAM cache, additional mounted virtual disk, auto-runs and probably registry change saving...just great. Only one question...why people forgot about it?
     
  9. pegr

    pegr Registered Member

    Joined:
    Apr 8, 2008
    Posts:
    2,279
    Location:
    UK
    It is true that there are changes that can be made, which will be written to the disk (the same is true if exclusions are made); but whether or not disk writes will actually occur depends on how the system is used while in Shadow Mode and whether a sufficiently large RAM cache is allocated to the virtual session.
     
  10. TomAZ

    TomAZ Registered Member

    Joined:
    Feb 27, 2010
    Posts:
    1,004
    Location:
    USA
    Can anyone give me some guidelines as to how much RAM is needed and/or should be allocated for RAM caching in SD - or Returnil 2008 - on a Windows XP SP3 system with a small 80GB internal HDD (about 45% full) and 2GB of RAM?
     
  11. bo elam

    bo elam Registered Member

    Joined:
    Jun 15, 2010
    Posts:
    3,770
    Location:
    Nicaragua
    In my XP SP3, similar to your system, I have never enabled the Ram option while using Shadow Defender but when I used WTF, I had the option on all the time (over two years) at 800MB. My XP in idle uses 200MB, normally if I use SD, I ll use it for a couple hours and reboot. If I was to use the Ram option in SD, I think 550/600MB would be the perfect amount for my case use.

    Bo
     
  12. The Shadow

    The Shadow Registered Member

    Joined:
    Jan 24, 2012
    Posts:
    814
    Location:
    USA
    Tom,

    While Bo's suggestion may work well with your config, it's my opinion that you won't see very much performance difference when in Shadow Mode with or without RAM allocated for SD cache. On the other hand, allocating too much of your 2GB RAM to SD cache could very well adversely impact Windows performance! 'Play' with it and see for yourself.

    TS
     
  13. TomAZ

    TomAZ Registered Member

    Joined:
    Feb 27, 2010
    Posts:
    1,004
    Location:
    USA
    Thanks Bo and TS -- both helpful. I primarily use SD for testing new software, so maybe the RAM option is not all that important or necessary when used this way. Right?

    Tom
     
  14. Osaban

    Osaban Registered Member

    Joined:
    Apr 11, 2005
    Posts:
    4,222
    I also think there is no change in SD performance/speed having the cache in RAM. With My Win8 (64bit) I allocated 4 out of 8GB and there was no perceived change. With my Vista I allocated 1 out of 2 GB and again I could see no change, as a matter of fact with Vista I reverted to version .325 which gave me the impression of being faster. These results could of course vary with different machines and OSs.
     
  15. The Shadow

    The Shadow Registered Member

    Joined:
    Jan 24, 2012
    Posts:
    814
    Location:
    USA
    Supposedly, running Shadow Mode with RAM-cache is faster and more secure than with HDD-cache, but imho neither benefit makes a substantial difference and in your situation it's not worth the penalty of depriving Windows of RAM (should you allocate any meaningful amount to SD).

    Of course for those who have an abundance of RAM it makes more sense to allocate some of it to SD, but that's not the case with your config, so I would stick with HDD-cache.

    TS
     
Loading...
Thread Status:
Not open for further replies.