# Boot or reboot to clean state on Windows each time?

I use virtual box to securely surf the web, but it's easy to get lazy and use the same image more than once. Currently, I have a golden Win 7 image that I built and loaded my required software. I then made a linked clone for different machine types. Examples are Sensitive machine, Non Sensitive, TOR machine etc. I use each VM for a different purpose (sensitive is for going to banks and brokerages, non-sensitive is for random web surfing).

1. Has anyone found a way to automate a snapshot restore at reboot?

2. Has anyone used linked clones in an automated fashion to generate a new machine each time and delete all the linked clone files at shutdown?

-
You can setup the machine to run on read-only mode and/or enforce this measure using a software like deep-freeze. –  happy Jan 2 '13 at 2:41

You can take a snapshot of a freshly installed Windows VM and revert to that snapshot each time you want a new OS.

You can automate restoring by using the VBoxManage tool:

VBoxManage snapshot restore <uuid>|<name>


The VBoxManage snapshot command is used to control snapshots from the command line. A snapshot consists of a complete copy of the virtual machine settings, copied at the time when the snapshot was taken, and optionally a virtual machine saved state file if the snapshot was taken while the machine was running. After a snapshot has been taken, VirtualBox creates differencing hard disk for each normal hard disk associated with the machine so that when a snapshot is restored, the contents of the virtual machine's virtual hard disks can be quickly reset by simply dropping the pre-existing differencing files.

The restore operation will restore the given snapshot (specified by name or by UUID) by resetting the virtual machine's settings and current state to that of the snapshot. The previous current state of the machine will be lost. After this, the given snapshot becomes the new "current" snapshot so that subsequent snapshots are inserted under the snapshot from which was restored.

The restorecurrent operation is a shortcut to restore the current snapshot (i.e. the snapshot from which the current state is derived). This subcommand is equivalent to using the "restore" subcommand with the name or UUID of the current snapshot, except that it avoids the extra step of determining that name or UUID.

-

I'm not sure I really understand your question but if your problem is to do "restore at reboot" why not just use the solutions already designed for this type of task (DeepFreeze, Returnil ...). You can even set it up on your VM clones. It's not necessary to use the cannon to kill a fly.

-

I would recommend you have a look at the honeynet project (www.honeynet.org) as a starting point. If you do a search for "honeyclient" and "virtualbox" you will find quite a few projects out there doing automated malware analysis on virtualbox. Although this is a bit more than you were looking for, many of the frameworks/methods would be applicable.

HTH.

-