Deleted Files Information

[DonkeyBomb89]

Hi,
I have a quick question: when exploring the Sandbox file system from Windows 10, how do I know if it has been deleted inside the Sandbox?

This is what I observe:
- a file deleted from within the sandbox, e.g. using a program, is not visible from withing the Sandbox (e.g. using sandboxed explorer)
- a file deleted from within the sandbox is still visible outside it (e.g. using regular explorer), in the path under:
C:\Sandbox\<username>\DefaultBox\...
I want to stress the fact that I deleted (from Windows 10) the files in the original directory (the one from which Sandboxie originally
copied the files), so I am not seeing these files when I open the above path on the FS.

In a similar question, it was suggested that Sandboxie fills a file with zeros and marks it with a special timestamp to indicate that it has been deleted inside the Sandbox. However, I could not find any trace of that.

This is what I observe:
- The file's binary content appears to be still identical to a clone of the original file
- The 'stat' command, executed under linux, does not show any special value within creation/access/change date fields

Could anyone help?

[Barb@Invincea]

Hello DonkeyBomb89,

Files deleted inside the Sandbox will not affect your host (meaning they will not be deleted from your host). To delete a file in the Sandbox please follow these steps:
https://www.sandboxie.com/DeleteSettings

You can right-click on your Sandbox and select: delete contents.
You can delete the files within a Sandboxed explorer.
To manually delete files, navigate to your Sandbox location (typically C:\Sandbox...) and delete the files via Windows Explorer (non-sandboxed).
To confirm that the files are no longer there, use Windows Explorer and search for them inside the Sandbox folders. If not found, then they are gone.

Here's more info if you want to use Secure Delete:
https://www.sandboxie.com/SecureDeleteSandbox

Regards,
Barb.-

[DonkeyBomb89]

Hello DonkeyBomb89,

Files deleted inside the Sandbox will not affect your host (meaning they will not be deleted from your host). To delete a file in the Sandbox please follow these steps:
https://www.sandboxie.com/DeleteSettings

Perhaps there is a miscommunication here. I don't want to delete files, I just want to be able to tell which files have been deleted inside the Sandbox.

I have an application that creates and deletes a file within the Sandbox.
When this file is deleted, it is no longer visibile from within the Sandbox.
However, it is still visible from outside the Sandbox by looking at the Sandbox files.

Thus, if I run a script on my system, and I explore all the files in the Sandbox, some of these are actually files that were already deleted within the Sandbox but are still visible outside of it. I want to be able to tell the script to ignore these files.

Since the file still exists after being deleted within the Sandbox, but it is not shown within the Sandbox, it stands to reason to believe that Sandboxie knows in some way which files were deleted and which files were not. I want to know the same thing, that's all.

[Barb@Invincea]

Hello DonkeyBomb89 ,

For deleted files, we set the creation date to the following:
#define DELETE_MARK_LOW 0xDEAD44A0
#define DELETE_MARK_HIGH 0x01B01234

Regards,
Barb.-