Next is Sandboxie, or SandboxIE, which is an excellent sandbox
that I recommend for Windows. It is shareware software.
The free version is missing a few features
which are available in the paid version.
And after 30 days of use, the free version
displays reminders to upgrade you
to the paid version, but remains functional.
The missing functionality is to automatically
run programs under Sandboxie even when they are
not started directly through Sandboxie.
This could be quite a useful function
and maybe you might need it.
Programs can be forced by name or by containing folder.
Another missing feature is running programs
in more than one sandbox at the same time,
which again could be useful. Prices are here.
Sandboxie is very simple to use out of the box,
but if you want to get the most out of it,
you will need to spend a little time configuring it
and working out what features they offer
so you can configure it to use it in the way you need.
Just download it as normal and install it.
It’s your usual, simple Windows install.
Or you can use Choco to install it.
Let’s do a search here for Sandboxie.
So you can see these two versions. One that actually installs.
It’s installing.
Downloading.
And there we go. Installed. And there it is.
And that’s what it looks like. And immediately
is popping up asking me if I want to apply
the configuration settings which will improve
compatibility with these applications.
So you can see here it’s the Windows and Office licensing service.
So you’d either have to look into that as to whether or not
that’s something you want it to do or not.
But yes, it’s okay.
I’ll give you some tips on Sandboxie.
If you see in the bottom right here, the sandbox icon is there.
You can right-click on here. And if you go up here,
this will show you here the sandboxes that you have.
At the moment, it’s just the default sandbox
which comes when you install it.
If you go up here, you can run each of these within a sandbox.
Your default web browser, email reader,
you can launch any program through the sandbox,
or through the start menu, or through Windows Explorer.
The way I tend to run things is just by right-clicking
and then run Sandboxed,
and then it will give you a choice of which sandbox you want to use.
You have different settings per sandbox.
So I can choose here the default sandbox, or to run outside the sandbox.
Obviously I want to run it as the default sandbox
and I don’t want to run it as administrator.
So there, Firefox has started within the default sandbox.
And you can tell it’s in the sandbox
because you can see this yellow box around it.
So now that is protected by the default sandbox,
and you can see this icon is changed.
It’s got some red dots on it because the sandbox is in use.
If I right-click on here again, go to Show Window,
this here is the sandbox,
and you can see what’s running within the sandbox.
And there obviously you can see that Firefox is there
and the accompanying processes that sandbox itself requires.
Now, I can configure this default sandbox
or the sandboxes that I want to use.
I go here, Sandbox Settings.
Make sure these two are ticked so that you can see a border
around the windows because what you can do is
accidentally think you're running something in sandbox and you're not.
So it’s always useful to have a yellow border around it.
Go to Recovery.
When you close your sandbox or the browser in this case,
it will delete content or ask you if you want to delete
content that you may have downloaded in this folder here.
But what’s set up automatically is what’s called Immediate Recovery.
Now let me show you what Immediate Recover is,
and it is quite useful. So, let’s go here.
So I’m choosing to download the file here just to demonstrate.
I’m choosing the file SDelete because we are going to use that later.
So let’s download that, save it,
and then this is what comes up.
This is because we’ve got immediate recovery set.
So instead of storing this within the sandbox straight away,
what it does is it says, “Do you want to store it in the sandbox,
or do we want to immediate recover it out of the sandbox
and put it within the real file system?”
So we can recover it here if we want.
We can recover and explore. We can recover and run.
So what I'm going to do is I'm going to close it here,
and this means it’ll be saved to the sandbox
and not the real file system.
So on the View, Files and Folders,
we can see there it is downloaded,
SDelete.zip in the Downloads folder.
Now, if you look in the Downloads folder, it isn’t there.
Actually it is there. This is a version I downloaded previously,
but the version I've just downloaded isn’t there
and because that is a zip file.
So the SD zip file isn’t here.
It isn’t in the Downloads folder.
Now, if I was to run Explorer, sandboxed,
with the default sandbox, the Explorer would
be able to see what is in the sandbox.
So, if I go in Downloads here, there we can see
the SDelete that is within the default sandbox.
And you can see here this is yellow.
Close that. I go back here, and you can see
it isn’t there when you're not sandboxed.
So let’s go back to our Options. Default, Sandbox Settings.
So there’s our Recovery options. This is set for
the Immediate Recovery. But you don’t
necessarily have that set.
You can choose at the end what you want to do
with the files that have gone into the sandbox.
Now Delete.
It’s usually a good idea to automatically
delete the contents of your sandbox
when the sandbox is closed or the application
that you’ve launched with the sandbox is closed.
So I usually add this set.
And then you’ve got the choice of Delete Command.
So you can securely delete or write
with random data or zeros and ones
over the content that’s in the sandbox,
and that’s a good idea.
So you want to use SDelete or Easer if you like.
So let me show you how you would do that.
Select SDelete, and we know where we’ve put that.
This is what I downloaded before. And there what you can see,
is it creates a special command so that when it deletes,
it deletes securely, or rather, it deletes multiple times.
This is three passes.
You can get both Eraser and SDelete with Choco if you want to,
as an example. So that’s installed.
And that will install Eraser.
So back to Sandboxie.
You can force processes or applications to run from a specific folder.
That could be quite useful with things like autoruns.
Now only for registered versions, paid for versions,
can you force particular programs to run.
This is a useful feature. So for example,
your browser, your mail client would be good to add here
so that it’s always run sandbox
and you don’t forget to run it sandboxed.
These programs will be automatically terminated
if they are still executing in the sandbox
after all the other programs have ended.
This is the amount of space that the sandbox has
in order to store downloaded files.
48 MB isn’t particularly much. I always increase
this to about 4 GB so I've got a fair bit of space.
But I don’t always have it on Immediate Recovery.
So I need to space in order to download the files
and then make a decision on what I'm keeping.
Restrictions here: you can prevent
programs from accessing the internet,
allow or deny programs to start and run,
and you can drop the rights if you're running as administrator.
You shouldn’t be running as an administrator,
but select that anyway just in case that happens.
Access restrictions: so if it’s a files,
registry access, IPC, Windows access, COM, you can specify
the sort of access that you want to allow the sandbox to have.
So, do you want to give any programs
full access, read access, write access?
Do you want to block anything in particular?
Generally, you want to give as little access as possible.
And then there’s Specific Application Settings that you can make.
So here we’ve got Firefox.
This is allowing a direct access to the phishing databases.
That can be okay for security.
And perhaps you want to keep cookies,
so you may have – so instead of
the sandbox being unable to access the cookies,
you may want to add the access there.
And then Specific Settings for various different Email Clients.
So there you go, that’s Sandboxie.
If you're using Windows, there’s no reason
really why you shouldn’t be using Sandboxie
or some other sandbox alternative in order to
give you that extra layer of sandbox protection.
This is a good document that I recommend.
It goes through using Sandboxie with
your browser and an email client.
So check that out, go through it
if you want to set up Sandboxie
with a browser or Firefox and your email client.
I’d also recommend the Sandboxie forums.
That way you can find quite a lot of information,
and if you’ve got any particular questions,
it is a good, responsive forum.