Deleted Files Information
Posted: Sat Jan 13, 2018 3:23 pm
Hi,
I have a quick question: when exploring the Sandbox file system from Windows 10, how do I know if it has been deleted inside the Sandbox?
This is what I observe:
- a file deleted from within the sandbox, e.g. using a program, is not visible from withing the Sandbox (e.g. using sandboxed explorer)
- a file deleted from within the sandbox is still visible outside it (e.g. using regular explorer), in the path under:
C:\Sandbox\<username>\DefaultBox\...
I want to stress the fact that I deleted (from Windows 10) the files in the original directory (the one from which Sandboxie originally
copied the files), so I am not seeing these files when I open the above path on the FS.
In a similar question, it was suggested that Sandboxie fills a file with zeros and marks it with a special timestamp to indicate that it has been deleted inside the Sandbox. However, I could not find any trace of that.
This is what I observe:
- The file's binary content appears to be still identical to a clone of the original file
- The 'stat' command, executed under linux, does not show any special value within creation/access/change date fields
Could anyone help?
I have a quick question: when exploring the Sandbox file system from Windows 10, how do I know if it has been deleted inside the Sandbox?
This is what I observe:
- a file deleted from within the sandbox, e.g. using a program, is not visible from withing the Sandbox (e.g. using sandboxed explorer)
- a file deleted from within the sandbox is still visible outside it (e.g. using regular explorer), in the path under:
C:\Sandbox\<username>\DefaultBox\...
I want to stress the fact that I deleted (from Windows 10) the files in the original directory (the one from which Sandboxie originally
copied the files), so I am not seeing these files when I open the above path on the FS.
In a similar question, it was suggested that Sandboxie fills a file with zeros and marks it with a special timestamp to indicate that it has been deleted inside the Sandbox. However, I could not find any trace of that.
This is what I observe:
- The file's binary content appears to be still identical to a clone of the original file
- The 'stat' command, executed under linux, does not show any special value within creation/access/change date fields
Could anyone help?