Re: Converting an external hard drive enclosure into a write blocker?

Max Gribov <[email protected]> Fri, 16 Nov 2007 22:14:07 -0500
Newsgroups gmane.comp.security.forensics
Message-ID <[email protected]>
Tom,
you can mount the storage as read-only - any unix filesystem will 
support read-only mount, and provided your root account isnt 
compromised, no one can remount it as write. Root cant write to 
read-only mounted filesystems without remount either.

mount -r /dev/da2 /readonly in BSD land..

Id say thats the easiest route without buying specialized hardware.

Sorry if this is something you already tried/thought about..

Tom Yarrish wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hey all,
> I wanted to find out if there was a method to convert an external hard 
> drive enclosure into a "cheap" write blocker device?  I'm not looking 
> for something to use from a forensic standpoint.  Basically if I want 
> to put a hard drive into an enclosure and pull data/burn data to 
> DVD/whatever off of it, but prevent anything from being written to the 
> drive, I can do that.
>
> Thanks ahead of time,
> Tom
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (Darwin)
>
> iD8DBQFHOmStZWzkfeDiTw4RAqcdAJ9FZ+QX3tnajnV4yaUPhK/R/xcqogCfV9Br
> h+Fb956D4hQWWJ2roctoIT8=
> =EOp6
> -----END PGP SIGNATURE-----