Re: Converting an external hard drive enclosure into a write blocker?

Terry Roebuck <[email protected]> Mon, 26 Nov 2007 09:05:12 -0600
Newsgroups gmane.comp.security.forensics
Message-ID <[email protected]>
A*nix read only mount would be my option of choice, but for windows, I 
hesitatingly ask could you not modify an IDE cable to make any connected 
drive 'read-only' (might require a resistor - not sure if you can just 
clip a wire? - maybe some one with better EE skills could answer that?)

Stefan Kelm wrote:

>>you can mount the storage as read-only - any unix filesystem will
>>support read-only mount, and provided your root account isnt
>>compromised, no one can remount it as write. Root cant write to
>>read-only mounted filesystems without remount either.
>>
>>mount -r /dev/da2 /readonly in BSD land..
>>    
>>
>
>Beware, however, that on journaling file systems such as
>ReiserFS or EXT3 you might incidentially change the file
>system although it is mounted read-only:
>
>http://www.mail-archive.com/[email protected]/msg20263.html
>
>Cheers,
>
>	Stefan.
>
>--------------------------------------------------------
>Stefan Kelm
>Security Consultant
>
>Secorvo Security Consulting GmbH
>Ettlinger Strasse 12-14, D-76137 Karlsruhe
>Tel. +49 721 255171-304, Fax +49 721 255171-100
>[email protected], http://www.secorvo.de/
>PGP: 87AE E858 CCBC C3A2 E633 D139 B0D9 212B
>
>Mannheim HRB 108319, Geschaeftsfuehrer: Dirk Fox
>  
>

-- 

Terry Roebuck
Dept. of Computer Science
http://www.cs.usask.ca/people/faculty.shtml
University of Saskatchewan
306 966 2532 (office)
306 966 4884 (dept office)
[email protected]