Trash Your Drive? Now You Can Have a Do-Over

In these days of endless network attacks from the Internet, we’re
constantly told that we should install the latest fixes from Microsoft
and other software vendors as quickly as possible. But we’re also told
that we should test these patches before we roll them out to the
hundreds or thousands of PCs in our companies, in case an update
wrecks one of our mission-critical programs.

So which is it? Distribute updates immediately or test thoroughly?

Now there’s a way you can install the most elaborate upgrade, try out
the strangest configuration, even experiment on your PCs with the latest
virus — and then return your test PC to its original state with
the push of a button. You no longer have to fear that whatever you’re
testing will make a machine unusable or subject you to hours of
manual uninstalls.

An Instant Do-Over That’s the Size of a Breadbox

This capability comes in the form of the Mulligan Test Lab from Voom
Technologies Inc., a small firm based in Lakeland, Minnesota. The
Mulligan, named after a muffed golf shot that everyone in your party
agrees to let you shoot again, is a box the size of a small PC. You run a
cable from an ATA hard drive in your test machine to the Mulligan, and another
cable from the Mulligan to the machine’s motherboard. The external device,
which you can carry from PC to PC for multiple tests if desired, requires no
drivers in the host machine.

When you install software on the target PC, or make other changes to its
hard disk, the Muligan intercepts the disk writes and saves them on
its own internal drive. From that point on, the host PC reads any unchanged
data from its own drive, but any requests for sectors that contain modified
data are served seamlessly by the Mulligan drive.

Here’s the beauty part: If you don’t like the results of whatever
change you made, you simply press a Leave-No-Trace button on the Mulligan
(or detach the cables) and the PC’s hard drive remains unchanged,
as though nothing had ever happened. On the other hand, if the modification
was successful, you push the Commit-Changes button and the updates are quickly
written to the PC’s disk as if the Mulligan had never been present at all.

How To Use Your New Omnipotence

Once you have the ability to experiment with PC changes — free from
the fear that you won’t be able to undo them — your mind can dream
up a wide variety of uses for this slick little box:

• Finally, Carefree Testing.
This is perhaps the first and most obvious application that comes to mind.
Go ahead and install every new patch and service pack that the fertile
brains at Microsoft can devise. No matter how bad the side-effects might
be, you can immediately reverse any installation. If so, you might decide to
implement a workaround suggested by Microsoft for a particular security
threat, rather than installing a full upgrade.

• Training.
Once you’ve accomplished a perfect configuration on which to train your
employees, plug a Mulligan into each PC and let your trainees come in and
bang away on them. Anything the trainees did over a period of days, weeks, or
months can immediately be wiped out and the original configuration restored.

• Virus Investigations.
You no longer need to worry about exposing a stand-alone PC to even the most
virulent Trojan horse or worm. Once you’ve examined a virus to analyze
its behavior, you can remove every trace of it with the press of a button.

Using a Hardware Approach vs. Installing Software

The Mulligan is unique in being entirely hardware-based, says Voom CEO
David Biessener. “Right now, Mulligan competes only with software,
like VMWare, or any kind of software ‘push-out’ product that pushes out
disk images, like Ghost,” he explains.

Unlike PC go-back solutions, such as FSLogic’s Protect 1.0, which I
reviewed
in January, the Mulligan requires the installation of no software. The device,
however, is more expensive per unit — listing for $1,495, compared
with $80 per workstation for Protect or $299 for VMWare — although
few corporations would choose to attach a Mulligan to every PC.

The device also works only with IDE hard drives, although the company
promises that a Serial ATA version will be available this year.

Conclusion

The Mulligan is so new, with no mention of it in any major media before
today, that it’s not in stores yet and must be purchased directly
from its manufacturer. CEO Biessener says that’ll change soon, but in
the meantime, visit the
Voom
Web site for information on how to order.

Voom also makes the so-called ShadowDrive, a $1,295 unit designed for
computer forensics investigators who must be able to examine a PC without
making any changes to its drive, and Instant Save Instant Restore (ISIR),
a $150 add-in board that provides a PC with an instant roll-back capability
to its last good configuration. ISIR competes with
CoreRestore,
a similar board from Core Protect Inc.

Biessener says he’s already received one U.S. patent for the technology
that underlies Mulligan, with four other patents pending —
so it’s anyone’s guess how soon you’d be able to buy anything similar
from another company.