Open Sketchy Files on a Computer You Can Delete

The Attachment You Have to Open

An invoice comes in from a vendor you actually use, but something’s off about it. A resume arrives as a .docx with macros. A client sends you a zip file and swears it’s fine. Somebody on your team wants to install a free PDF tool they found.

The security advice is always the same: don’t open it. Which is great advice right up until you’re running a business and you actually need to know whether that invoice is real.

So build yourself a computer you can throw away. Open the thing there. If it’s malicious, you delete the computer and go make coffee.

The Free Option Hiding in Windows

Before you build anything, check whether you already have this. If you’re running Windows 10 or 11 Pro or Enterprise, you have Windows Sandbox built in and turned off.

Turn on Windows Features from the Start menu, tick Windows Sandbox, reboot. Now you have a Start menu item that opens a clean, disposable Windows desktop in about ten seconds. Drag your suspicious file in, look at it, close the window. Everything inside is destroyed permanently. Next launch starts fresh again.

It’s not a full analysis lab. It shares the clipboard by default and it does have network access, both of which you can turn off with a small config file. But for the everyday question of ‘is this PDF going to wreck my laptop,’ it’s free, it’s already on your machine, and it takes five minutes to enable. Most small business owners should stop right here and be happy.

Running Windows Home? You don’t get Sandbox. Keep reading.

Building the Real Thing

If you want something you can snapshot, keep around, and use for testing software rather than just opening files, you want an actual virtual machine.

What you need

A machine with 16GB of RAM if you can manage it. 8GB works if you’re patient.
VirtualBox (free, works everywhere) or Hyper-V (already in Windows Pro) or VMware Workstation (the free tier covers personal use)
A Windows 11 evaluation ISO from Microsoft’s own site, or a Linux ISO if you’re testing anything that doesn’t need Windows
An afternoon

The build

Install your hypervisor, create a new VM, point it at the ISO, and give it 4GB of RAM and 60GB of disk. Install the OS. Skip signing into any Microsoft account. Don’t install your password manager. Don’t sign into your email. The whole value here is that this machine knows nothing about you.

Then do the two things people skip, which are the two things that matter.

Set the network adapter to host only, or turn it off entirely. Default VM networking bridges the machine right onto your home or office network, where it can see your NAS, your cameras, and your other computers. Host only means the VM can talk to the host and nothing else. If you have VLANs on your network already, put it on the isolated one and be done.

Turn off shared folders and clipboard sharing. Those are convenience features that punch a hole straight through the wall you just built. Move files in by mounting an ISO or dragging once and then disabling it. Never leave a shared folder pointed at your actual documents.

Then take a snapshot

This is the part that makes the whole thing worth it. With the VM freshly installed, clean, and patched, take a snapshot and name it something like Clean Base.

Now you can do anything. Open the file, install the sketchy software, click the link, watch what happens. When you’re done, restore the snapshot and the machine is back to clean in about fifteen seconds. No reinstalling. No wondering whether something stuck around.

What to Actually Do With It

Open questionable attachments. Did the invoice ask you to enable macros? That tells you what you needed to know.
Test software before it hits real machines. Install that free tool your team wants and watch what it bundles.
Check where a link really goes. Click it in the VM, watch the redirect chain, see the fake login page for what it is.
Practice. Break Windows on purpose. Learn Group Policy. Try a Linux distro. Restore the snapshot when you’re finished. A lab you can’t break is a lab you won’t learn anything from.

What It Won’t Do

Being straight with you here, because too many people treat a VM as a magic force field.

Plenty of malware checks whether it’s running in a VM and simply sits quiet if it is, so ‘nothing happened’ isn’t proof of anything. VM escapes are rare but they exist, which is why you keep your hypervisor updated. And a sandbox does nothing at all about the credentials you type into a convincing fake login page, because you typed those in yourself.

Also worth knowing: uploading a file to VirusTotal to check it is a good habit, but that file becomes available to paying subscribers of the service. Do not upload client contracts, invoices, or anything with customer data. That has caused real breaches at real companies.

Weekend Project, Permanent Payoff

Enable Windows Sandbox tonight, it’s five minutes. Build the full VM this weekend if you want the deeper version. Either way you stop having that uncomfortable moment where you’re hovering over an attachment doing risk math in your head.

This is exactly how we work at YourTech. Everything gets tested in a lab before it goes anywhere near a client network, because finding out something breaks on a Tuesday in production is the expensive way to learn.

Want a hand setting up a test environment, or want somebody to look at a file you’re not sure about? We work with businesses from Delray Beach to West Palm Beach and we like this stuff. Always happy to troubleshoot.