Eliminate unwanted changes to PCs with HDD Sheriff
By James McPherson
May 16, 2002, 7:00am PDT

Every IT department has computers they wished were inviolate. Maybe it belongs to the resident know-it-not, gets used by roaming sales staff temporarily in the office, or sits in the training room. Wherever it is, you know that a user will eventually change something that causes the PC to be out of commission while it gets reimaged or while you attempt to recover its data.

To help defend against unwanted computer changes, Jungsoft created the HDD Sheriff product line. The HDD Sheriff system I reviewed consists of a PCI card key, Windows software, and a boot manager. There are USB, parallel, ISA, and PCI versions of the HDD Sheriff, including a PCI NIC. I received the stand-alone PCI version and tested it on Windows 98, 2000, and in dual-boot mode. I'll share the results of my testing with you here.
Wait, there's more!
Check out a brief review of the USB version of HDD Sheriff by clicking here.
Know the computer's role before you install
Think very carefully about the role the computer will play before installing HDD Sheriff. A “secured,” single-user desktop will be far different from a shared workstation, a training computer, or kiosk. Each will need different access to create and modify files. A shared workstation is probably the most difficult system on which to set up HDD Sheriff, because of the multiple users (possibly multiple operating systems) and various degrees of file sharing involved. Also, with more complicated setups, don't expect that setting up the partitions for HDD Sheriff will go perfectly the first time.

Installation
The HDD Sheriff manual provides a step-by-step walk-through of the painless but interesting installation process. One word of caution before you begin the installation: HDD Sheriff is going to repartition the hard drive.

After placing the PCI card in my (unpowered) system, I booted up and fed Windows the floppy when it asked for it. No CD is included, which may be a problem if anyone is working on a legacy-free system like my new floppy-less workstation. Not really an issue today, but floppies are slowly going the way of the dodo.

The software setup is accomplished via a series of relatively simple, easy-to-maneuver menus. Simply decide if this is a single OS, multi-OS, or custom install. Next, create unprotected partitions, select the directories to be relocated to the unprotected partitions (e.g., Outlook mail directory, My Documents, browser files, etc.), select a password, and reboot with the floppy in the drive.

The first boot takes a very long time, as HDD Sheriff uses its own defragmentation process to free up disk space and create the partitions needed. The program apparently does not have a fragmentation detection process, as my test computer was freshly formatted and it still took an inordinate amount of time. Then, there's another reboot (without the floppy), after which HDD Sheriff creates the backup files it needs to operate. The creation of the backup files only takes about a minute, and then the system proceeds to boot into Windows with HDD Sheriff in Supervisor mode so the Registry keys can be finalized.

The test
Testing was fairly simple: I tried to delete a few files to see if they remained deleted after a reboot. My initial guess was that HDD Sheriff keeps copies of the FAT tables and several other choice bits of data in a private partition, from which it pulls the correct configuration when the files need to be restored. If my hunch was correct, it meant that deleting files (the most common task) was pointless. But I tried it anyway, and I found that all of the files were restored upon reboot. I tried modifying files, but the changes were eliminated. Then I went into devious mode. Calling upon Murphy’s Law, I imagined the worst possible way a user could make data disappear. So I deleted a file called Victim.txt and copied several large JPEGs to the protected partition. The coup de grace was to run a disk defragmentation afterwards.

The defragmenting process moved those large JPEG files into the space formerly occupied by Victim.txt. If HDD Sheriff didn’t make a complete copy of the Victim.txt, I knew the file would be a goner. It would take an actual data recovery lab to get the data back once the drive has recorded over it, and even then there’s no guarantee, since the bits have been overwritten.

I rebooted with what was probably my best Black Bart smirk but found that Victim.txt was safe and uninjured, while my JPEG files were not to be seen. Obviously, HDD Sheriff is doing something more complex than just keeping copies of the FAT tables; it's likely functioning more along the line of a “virtual” disk driver that intercepts file operations so it can shuffle things around as needed. This seems more probable, since the small partition it established during installation is invisible to Windows 2000 Disk Manager. (Windows 2000 will normally see a partition, even though it may not be able to identify it.)
Pricing
The HDD Sheriff ranges from $69.95 for the PCI version I tested to $79.95 for the 10/100 NIC versions. Jungsoft also offers a USB variant for $49.95. Of course, these are list prices; I was able to find the PCI version for $53, the NIC version for $55, and the USB for $35 in about 10 minutes using a search engine.
Verdict
Jungsoft has a nice product on its hands. The installation process’ relaxed attitude towards rearranging partitions is really my only complaint, and I wouldn’t recommend installing it on a “live” workstation that hasn’t been backed up. While it isn’t appropriate for all computers (most users would become irate if they couldn’t install software), you should seriously consider it for training rooms and shared workstations. In some cases, disk imaging could be the superior solution, but if you have a mixed hardware environment, imaging may not be feasible. In those situations, the HDD Sheriff handily saves the day.

Sleepless_mind: >
program koji bi pomogao je perfect keylogger...a ono za admin samo LOL i
nista drugo

choks87: Da svi vi/mi lepo imamo Linux koji je multiuser sistem...eh...toga ne bi bilo.

Ali sto da koristimo besplatni softver,kad mozemo winblows da placamo?

choks87: Da svi vi/mi lepo imamo Linux koji je multiuser sistem...eh...toga ne bi bilo.
Ali sto da koristimo besplatni softver,kad mozemo winblows da placamo?