Skip to content

Commit

Permalink
Fixes and additions
Browse files Browse the repository at this point in the history
  • Loading branch information
isaak654 committed Feb 5, 2024
1 parent 5366462 commit 728c4b8
Show file tree
Hide file tree
Showing 4 changed files with 33 additions and 33 deletions.
2 changes: 1 addition & 1 deletion .github/workflows/action.yml
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ jobs:
uses: lycheeverse/[email protected]
with:
# Check all markdown files in repo
args: -vvv --no-progress --accept 200,429 './**/*.md'
args: -vvv --no-progress --max-redirects 50 --accept 200,429 './**/*.md'
fail: true

# To avoid automated spam, try to find an existing open issue before opening a new one
Expand Down
6 changes: 6 additions & 0 deletions Content/FileRootPath.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,12 @@ Usage:
FileRootPath=C:\Sandbox\MySandbox
```

Related [Sandboxie Control](SandboxieControl.md) setting: [Sandbox menu > Set Container Folder](SandboxMenu.md#set-container-folder)

Related Sandboxie Plus setting: Options menu > Global Settings > Advanced Config > Sandboxie Config > Sandbox file system root

**Technical Details**

The following substitution variables may be useful in this path.

* [Shell Folders](ShellFolders.md) variables such as %Personal% which expands to the user's Documents folder
Expand Down
56 changes: 25 additions & 31 deletions Content/PrivacyConcerns.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@

This is an advanced topic, which explains that even after running a program under Sandboxie, your computer may still record _which_ programs were executed or what they did. It is important to emphasize that this is not a security breach as it will never allow sandboxed programs to infect or otherwise abuse your computer. However, this may be interesting reading for those concerned with the privacy aspects of using Sandboxie.


**Overview**

The guiding principle of Sandboxie is to isolate and contain any actions taken by programs that Sandboxie supervises, for the purpose of keeping your computer and operating system in a clean and healthy state.
Expand All @@ -25,37 +24,33 @@ This component is designed to improve application start up time by keeping copie

Windows may store copies of programs files in this Prefetch folder even when the programs were executed under Sandboxie.

Prefetch behavior can be reduced to caching only programs using during the boot sequence, or to not cache anything at all. Follow these links for more information:
Prefetch behavior can be reduced to caching only programs using during the boot sequence, or to not cache anything at all. For more information:

[https://www.ghacks.net/2008/01/13/enableprefetcher-in-prefetchparameters](https://www.ghacks.net/2008/01/13/enableprefetcher-in-prefetchparameters)
<br>
[https://www.howtogeek.com/998/change-superfetch-to-only-cache-system-boot-files-in-vista](https://www.howtogeek.com/998/change-superfetch-to-only-cache-system-boot-files-in-vista)
<br>
[https://www.howtogeek.com/989/how-to-disable-superfetch-on-windows-vista](https://www.howtogeek.com/989/how-to-disable-superfetch-on-windows-vista)

**MUI Cache**

Windows Explorer records in the registry the names of programs that are launched directly through it. This includes launching programs through the Start menu, the desktop, the quick launch area, or any folder views. It is true even if the right-click "Run Sandboxed" action is used to launch the program under Sandboxie.

The recorded information is kept in this registry key:
```
HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
```
The recorded information is kept in this registry key: _HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache_

If launch a program through a Sandboxie facility (such as the Sandboxie Start menu) or through a program which is already running under Sandboxie, then this information is kept in the registry inside the sandbox.

There are various third-party registry clearing tools that can erase this information.
There are various third-party registry cleaning tools that can erase this information.

**Windows Taskbar**

**Windows 7 Taskbar**
On Windows 7 and later, Windows Explorer stores information associated with icons on the taskbar. This information includes the icon for the program and the command used to launch it. The information is stored in files in the following folder, within the user profile folder: _%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts_

On Windows 7 and later, Windows Explorer stores information associated with icons on the taskbar. This information includes the icon for the program and the command used to launch it. The information is stored in files in the following folder, within the user profile folder.
```
%Appdata%\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts
```
The [Sandbox Settings > Applications > Miscellaneous](ApplicationsSettings.md#miscellaneous) settings page includes the setting "Permit programs to update jump lists in the Windows 7 taskbar". If this setting is enabled, additional files are created in the following folders, within the user profile folder:

The [Sandbox Settings > Applications > Miscellaneous](ApplicationsSettings.md#miscellaneous) settings page includes the setting "Permit programs to update jump lists in the Windows 7 taskbar". If this setting is enabled, additional files are created in the following folders, within the user profile folder.
```
%Appdata%\Microsoft\Windows\Recent\CustomDestinations
%Appdata%\Microsoft\Windows\Recent\AutomaticDestinations
```
_%AppData%\Microsoft\Windows\Recent\CustomDestinations_
<br>
_%AppData%\Microsoft\Windows\Recent\AutomaticDestinations_

**Windows Page File**

Expand All @@ -65,43 +60,42 @@ Programs that run under Sandboxie are still running in the same Windows operatin

It is possible to configure Windows to clear the contents of the page file at shutdown. More information [here](https://winaero.com/clear-pagefile-shutdown-windows-10) and [here](https://www.vistax64.com/threads/virtual-memory-paging-file-clear-at-shutdown.157323).

It is possible to configure Windows Vista to encrypt the contents of the page file:
```
* Run _secpol.msc_ to open the Local Security Policy editor
* Expand the group labeled _Public Key Policies_
* Right-click _Properties_ on the item labeled _Encrypting File System_
* Select _Allow_ to enable Encrypting File System
* Check the box to _Enable pagefile encryption_.
* Click OK and reboot to put the new setting into effect.
```
It is possible to configure Windows to encrypt the contents of the page file:

* Run _secpol.msc_ to open the _Local Security Policy_ editor
* Expand the group labeled _Public Key Policies_
* Right-click _Properties_ on the item labeled _Encrypting File System_
* Select _Allow_ to enable Encrypting File System (EFS)
* Click _Apply_ and then _OK_
* Reboot to put the new setting into effect

**Windows Hibernate File**

Similar to the Windows Page File, the hibernate file stores a copy of the memory and state of the system before the computer is turned off as part of the hibernate process. Thus the hibernate file may contain bits of memory that were used by a sandboxed program.

**System Restore**

Restore points are snapshots of the state of the operating system at some points in time. The System Restore components in Windows XP and later versions of Windows records and restores these snapshots.
Restore points are snapshots of the state of the operating system at some points in time. The System Restore component in Windows XP and later versions records and restores these snapshots.

Snapshots are recorded in the (typically inaccessible) folder called _System Volume Information_ and may include [many types of files](https://docs.microsoft.com/en-us/windows/win32/sr/monitored-file-extensions) found throughout the system, including within the folders of the sandbox.

Thus it is possible that System Restore will create backup copies in its folders for files or programs that exist only in the sandbox.

The System Restore component ignores files and folders in temporary folders, so [moving the sandbox](SandboxMenu.md) to C:\TEMP\SANDBOX instead of the default C:\SANDBOX should cause System Restore to ignore the sandbox when creating a snapshot.
The System Restore component can be set to ignore files and folders in temporary folders, so [moving the sandbox](FileRootPath.md) to _%TEMP%\SANDBOX_ (instead of the default _C:\SANDBOX_) and adding the path within the registry key [FilesNotToSnapshot](https://learn.microsoft.com/en-us/windows/win32/vss/excluding-files-from-shadow-copies#using-the-filesnottosnapshot-registry-key), System Restore should ignore the sandbox when creating a Shadow Copy snapshot. More information [here](https://learn.microsoft.com/en-us/windows/win32/backup/registry-keys-for-backup-and-restore).

**System, Audit and Other Event Logs**

Windows sometimes records bits of information about running programs in its various [event logs](https://en.wikipedia.org/wiki/Event_Viewer). Typically, very little if any information is logged about a program. However, if security auditing has been enabled for some aspects of the system, Windows will have no trouble logging the details of any actions taken by a program running under Sandboxie.

Windows has an Event Viewer program which can be used to view and delete the event logs. [More information here](https://www.howtogeek.com/123646/htg-explains-what-the-windows-event-viewer-is-and-how-you-can-use-it).
Windows has an Event Viewer program which can be used to view and delete the event logs. More information [here](https://www.howtogeek.com/123646/htg-explains-what-the-windows-event-viewer-is-and-how-you-can-use-it).

**Windows System Tray Icons**

When a programs which is running under Sandboxie asks to place an icon in the [system tray area](https://www.computerhope.com/issues/chsys.htm), Sandboxie lets the program place the icon in the real system tray, which is typically located at the bottom right corner of the display.

This has the advantage that interaction with the tray icon of the sandboxed program is as easy as interacting with any other tray icon. However, it also means that Windows will record this icon and its description in the history of all tray icons it has ever displayed.

It is possible to manually clear this history in [Windows](https://www.howtogeek.com/739/clean-up-past-notification-icons-in-windows-vista). There may also be third-party registry clearing tools that can erase this information.
It is possible to manually clear this history in [Windows](https://www.howtogeek.com/739/clean-up-past-notification-icons-in-windows-vista). There may also be third-party registry cleaning tools that can erase this information.

**Disk Defragmentation**

Expand All @@ -119,4 +113,4 @@ There are various third-party solutions for anonymous Web access. More informati

**Windows DNS Host Cache**

Sandboxie does not prevent the logging and storage of DNS Hosts files (Your DNS cache) on your Windows machine. This is written to C:\Windows\System32\drivers\etc in Windows.
Sandboxie does not prevent the logging and storage of the _hosts_ file (DNS cache) on your Windows machine. This is written to _C:\Windows\System32\drivers\etc_.
2 changes: 1 addition & 1 deletion Content/SandboxMenu.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ The _Create New Sandbox_ command defines a new sandbox in Sandboxie. A dialog bo

### Set Container Folder

The _Set Container Folder_ command selects the container (or master, or parent) folder which will contain all other sandboxes. The default location is **X:\Sandbox\%USER%\%SANDBOX%**, where **X:** stands for the drive where Windows is installed, typically **C:**.
The _Set Container Folder_ command selects the container (or master, or parent) folder which will contain all other sandboxes. The default location is **X:\\Sandbox\\%USER%\\%SANDBOX%**, where **X:** stands for the drive where Windows is installed, typically **C:**.

The special variable **%SANDBOX%** is replaced by the name of the sandbox.

Expand Down

0 comments on commit 728c4b8

Please sign in to comment.