Recovering data from a sandbox
I was working on a computer which had Avast
software running on it. I tried to open an executable (CoolEdit
) which Avast
opened in sandbox mode. I recorded a lot of stuff with CoolEdit and closed it down. The sandbox operates in a mode that says : Attention: Any data remaining when the session is closed will not be saved
, or something to that effect. I saved all my data and was even able to see it before I closed CoolEdit
down. Now I find it is not there. My questions:
Once you have closed the session down (by closing the application that is being run in the sandbox), it is unlikely that the data can be recovered. However, when the application is running in the sandbox, you will see all files as being saved in the locations that you have saved them (only through the dialog boxes of the application though. In reality, the files are not being stored there at all). Avast
creates a directory called ## awsnx
or something on those lines. All the data that has been saved in the session will be saved in a sub-folder within that directory. Please note that this data in the sub-folder will exist only as long as the session lasts. Once the session is over, all that data will be lost.
Word of advice to anyone using Avast. Disable this feature. You will lose anything that it deems suspicious, without giving you any way to recover it.
Say for instance, your Email. It for some reason thinks today "Ahha suspicious!" and sandboxes it while it scans it.. Oh hey nothing there.. I'll close it out of sandbox and run it normally.... Minues the 20-30 Emails you received as it was screwing around with your Email application.
Gone. No recovery.
As it is, for this I am uninstalling avast. I'd rather put up with mcaffee.
精彩评论