Use Returnil to create a Virtual System in Memory

One of the latest security trends is to use virtual systems to protect the computer from harm. The benefit of those systems is that changes are only temporary and undone after the next reboot which means that you always start with a fresh system. Most users do not want to use virtual systems because they seem complicated to setup and maintain.

Returnil offers an easy way of installing a virtual system on your Windows XP, 2000 or Vista 32-bit operating system. The installation looks like any other software installation except for the fact that have to make the decision if you want to create a virtual partition. The virtual partition is not needed to run Returnil and would only be used to have a save place for saved files and data other than saving those on the Internet or on removable drives.

Once the setup has completed you can turn on system protection which has the effect that all changes to the system will be undone after the next reboot. I was a bit puzzled on how Returnil keeps track of all files and settings to return them to their previous state which is astonishing if you consider that it is only running in RAM.

They answer that question in the faq section vaguely:

There is absolutely no reason to save the entire contents of the System Partition outside of a normal system backup or recovery image. As Returnil does not allow changes to the real System Partition with Protection ON, there is no need to carry the extra baggage of an image except as noted above or in a full-blown testing environment which lab testing software handles quite well.

Pros:

No configuration except turning it on or off
Most user friendly virtual system software
Runs in RAM which speeds up processes
Will undo changes after rebooting the system

Cons:

Software that needs reboots can’t be tested
Permanent changes require a reboot (in the unprotected system)
Deleting data requires a reboot (in the unprotected system)

Related Articles:

Author: Martin Brinkmann, Tuesday November 27, 2007 -
Tags:Security, software virtualization, windows software

Responses so far:

1. Jojo says:

   December 26, 2007 at 12:42 pm

   I am not sure that I see the value of something like this except for very defined testing in a vanilla system environment. It is simply too much work to reboot and start allover again if you have done anything more than just test one function. It would be easier to load an Acronis image instead, I think.

   Also, it is not clear, where they refer to the “system partition”, if they work similar to the system restore function in XP, which only protects system files.

   I have 10 logical disks running on 4 physical drives. Would EVERYTHING I do in a Returnil session be covered,or only what occurred on the system drive?

   Reply
2. Tiago says:

   February 8, 2010 at 12:04 am

   i don’t see the advantage over Sandboxie (google it)

   Reply