New answers tagged file-system
Assuming it's not a malicious software, then the easiest way to do this is to use an overlay filesystems (e.g. UnionFS, OverlayFS). The changed files will be basically be in the overlay. Another option is to make use of filesystem that have snapshot capability (e.g. btrfs) or LVM snapshot. If the software is a malicious software, you may need to use ...
With a system like rubberhose it would be extremely easy to destroy a file systrm. Just delete the master key for a rubberhose partition and it can no longer be decoded or even detected.
Top 50 recent answers are included