Home IN-DEPTH Windows Sandbox Tutorial and In-Depth Analysis

Windows Sandbox Tutorial and In-Depth Analysis

by Cengiz Kuskaya

What is Windows Sandbox ?

Windows Sandbox is a Windows 10 Feature which you can enable over Control Panel\All Control Panel Items\Programs and Features . After enabling this feature it will appear as “Windows Sandbox” in Start Menu. Windows Sandbox is a an isolated Windows 10 Virtual Machine of your current Windows 10 Operating System. Once you click on Windows Sandbox, Windows 10 automatically creates Base and Differencing Snaphots of your Windows 10 OS on the fly and saves the generated Snapshots inside the mentioned below *.vhdx files. By default 4 GB of Memory is automatically assiged to the VM. Therefore you should have at least 8 GB of Memory on your PC. The Windows 10 VM is a non-genuine copy of your current OS. Windows Sandbox is in other words a test machine which you can use to test unstable or suspicious applications. Once Windows Sanbox is closed "BaseLayer.vhdx" will be deleted automatically and the rest of the *.vhdx files will be emptied (Allocated disk space will be released).

Windows Sandbox *.vhdx Path :
C:\ProgramData\Microsoft\Windows\Containers\Sandboxes\3be05345-ef49-4c9c-989a-2c35bcba4dfc\Sandbox.vhdx

C:\ProgramData\Microsoft\Windows\Containers\BaseImages\4c132db2-a7e5-45d0-a1ea-ac690113d03b\BaseLayer.vhdx

C:\ProgramData\Microsoft\Windows\Containers\BaseImages\4c132db2-a7e5-45d0-a1ea-ac690113d03b\Snapshot\SnapshotSandbox.vhdx

C:\ProgramData\Microsoft\Windows\Containers\BaseImages\4c132db2-a7e5-45d0-a1ea-ac690113d03b\Snapshot\SystemTemplate.vhdx

C:\ProgramData\Microsoft\Windows\Containers\BaseImages\4c132db2-a7e5-45d0-a1ea-ac690113d03b\Snapshot\SnapshotSavedState.vmrs
Steps :

1. Programs and Features > Windows Sandbox

2. Start Menu > Windows Sandbox

3. Sandboxed Windows 10 VM

Good luck !