search

sandboxie-plus / Sandboxie

Sandboxie Plus & Classic
https://Sandboxie-Plus.com
GNU General Public License v3.0
13.69k stars 1.52k forks source link

How does sandboxie track deleted files [Question] #389

Closed typpos closed 3 years ago

typpos commented 3 years ago

When a file/folder exists outside the sandbox and I delete it inside the sandbox (no write-through etc), how does sandboxie track the deleted state so that sandboxed applications can't see the file?

DavidXanatos commented 3 years ago

Sbie keeps an empty "deleted" folder or an empty file, and sets one of the file attributes (the creation time) to a "Magic Value" (0x01B01234DEAD44A0) whenever sbie enumerates or accesses sandboxed files it checks this attribute for that value and if its found acts as if that file or folder would not exist neither in nor outside the box.