Forensics
Re: Converting an external hard drive enclosure into a write blocker? Nov 20 2007 08:27AM
Stefan Kelm (stefan kelm secorvo de) (1 replies)
Re: Converting an external hard drive enclosure into a write blocker? Nov 26 2007 03:05PM
Terry Roebuck (terry roebuck usask ca)
A*nix read only mount would be my option of choice, but for windows, I
hesitatingly ask could you not modify an IDE cable to make any connected
drive 'read-only' (might require a resistor - not sure if you can just
clip a wire? - maybe some one with better EE skills could answer that?)

Stefan Kelm wrote:

>>you can mount the storage as read-only - any unix filesystem will
>>support read-only mount, and provided your root account isnt
>>compromised, no one can remount it as write. Root cant write to
>>read-only mounted filesystems without remount either.
>>
>>mount -r /dev/da2 /readonly in BSD land..
>>
>>
>
>Beware, however, that on journaling file systems such as
>ReiserFS or EXT3 you might incidentially change the file
>system although it is mounted read-only:
>
>http://www.mail-archive.com/reiserfs-list (at) namesys (dot) com [email concealed]/msg20263.html
>
>Cheers,
>
> Stefan.
>
>--------------------------------------------------------
>Stefan Kelm
>Security Consultant
>
>Secorvo Security Consulting GmbH
>Ettlinger Strasse 12-14, D-76137 Karlsruhe
>Tel. +49 721 255171-304, Fax +49 721 255171-100
>stefan.kelm (at) secorvo (dot) de [email concealed], http://www.secorvo.de/
>PGP: 87AE E858 CCBC C3A2 E633 D139 B0D9 212B
>
>Mannheim HRB 108319, Geschaeftsfuehrer: Dirk Fox
>
>

--

Terry Roebuck
Dept. of Computer Science
http://www.cs.usask.ca/people/faculty.shtml
University of Saskatchewan
306 966 2532 (office)
306 966 4884 (dept office)
terry.roebuck (at) usask (dot) ca [email concealed]

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus