Which Areas Are Protected and Where They Are Virtualized

Seeing File Virtualization in Action

I find it easier to understand things when I see them work, so let's try out some file virtualization. Now, to do this, we clearly need a Vista-dumb legacy application, and I don't know about you, but I'm fresh out of them. So I wrote a few "legacy" applications that we can use to put file and, later, Registry virtualization through their paces. To try out this demonstration, you'll need to grab two program files from my website and save them to C:\mystuff, the folder that I had you create in the previous chapter. The files to download are located at http://www.minasi.com/vista/show.exe and http://www.minasi.com/vista/createfile.exe.

The createfile.exe program takes just one argument, a file name. It then creates a file by that name and puts the text "Hello, World!" in it. We'll use that to simulate what happens when a legacy program tries to write to a protected space, as we'll try to write a file to C:\Windows. Then we'll use show.exe, which is a "legacy" application that takes just one argument, a file name, and shows the contents of that file on the screen. In essence, show.exe just duplicates the function of the command-line tool type, which has been around since DOS 1.0.

Note 

So why don't we just use the type command? Because Vista knows that the type that came with Vista is made for Vista. Vista never does file and Registry virtualization in combination with Vista apps. We'll see later that most applications will not enjoy the benefits of file and Registry virtualization, when I explain how Vista decides when to enable that virtualization and when not to. Microsoft calls applications that Vista monitors to see if it should automatically redirect reads and writes to "virtualized" applications, so we could say that createfile is virtualized and type is not.

Make sure that you're logged on either as a standard user or an administrator in Administrator Approval Mode; this won't work if you've disabled UAC or if you try these commands from the default Administrator account. Open a command prompt, navigate to C:\mystuff by typing cd c:\mystuff, and then type these two lines:

 createfile c:\windows\testfile.txt show c:\windows\testfile.txt 

You should get a response of Hello, World! indicating that both createfile and show succeeded. Then try this:

 type c:\windows\testfile.txt 

Remember, Vista knows that type isn't a legacy app, and so doesn't bother with virtualizing it. So type responds not with Hello, World! but instead with a grumpy The system cannot find the file specified. Why did type fail? Simple: because we told it to go looking in the Windows folder for a file named testfile.txt and there isn't anything by that name in the Windows folder!

But don't believe me, friends-let's look in C:\Windows and see what we find. Before we do, however, we're going to need to be able to see hidden folders in order to observe the true location of testfile.txt, so if you haven't done it yet, tell your Vista system to show hidden files and folders and, while we're at it, tell it not to hide file extensions. In case you're still figuring out Vista's interface, here's how:

1. Click Start Computer.

2. In the upper left-hand side of the Computer folder, there's a rectangular icon-like thing labeled "Organize." Click that, and a menu will drop down.

3. In that menu, click Folder and Search Options.

4. That brings up a property page Folder Options; click the View tab.

5. In the Advanced Settings box, find the "Hidden files and folders" item, and click the radio button labeled "Show hidden files and folders."

6. Right under that, uncheck the box labeled "Hide extensions for known file types."

7. Click OK to dismiss Folder Options.

   Note 

   It's times like this that I really hate GUIs. We ought to be able to just type folderview hidden=yes or the like from the command line, press Enter, and be done with it. Or, better, to be able to just show hidden things with a group policy.

8. Back in the Explorer window, open up C:.

9. Navigate to C:\Windows.

10. Look around, and you will see that there is no testfile.txt in C:\Windows, just as promised.

So where is it?

1. Still working with Explorer, look in C:\Users for a folder whose name matches your username.

2. Open that folder. Inside it, you'll see a folder named AppData. Open that.

3. Inside that, open up the Local folder. Inside that you'll find a folder named VirtualStore. Inside that, you'll find a folder named Windows …and that contains testfile.txt.

Still skeptical? Edit testfile.txt with Notepad and put some different text in it than Hello, World! and then return to the command line and type show c:\windows\testfile.txt and you'll see whatever text you just put into testfile.txt.