Re: Converting an external hard drive enclosure into a write blocker?
Terry Roebuck <[email protected]> Mon, 26 Nov 2007 09:05:12 -0600
| Newsgroups | gmane.comp.security.forensics |
|---|---|
| Message-ID | <[email protected]> |
A*nix read only mount would be my option of choice, but for windows, I hesitatingly ask could you not modify an IDE cable to make any connected drive 'read-only' (might require a resistor - not sure if you can just clip a wire? - maybe some one with better EE skills could answer that?) Stefan Kelm wrote: >>you can mount the storage as read-only - any unix filesystem will >>support read-only mount, and provided your root account isnt >>compromised, no one can remount it as write. Root cant write to >>read-only mounted filesystems without remount either. >> >>mount -r /dev/da2 /readonly in BSD land.. >> >> > >Beware, however, that on journaling file systems such as >ReiserFS or EXT3 you might incidentially change the file >system although it is mounted read-only: > >http://www.mail-archive.com/[email protected]/msg20263.html > >Cheers, > > Stefan. > >-------------------------------------------------------- >Stefan Kelm >Security Consultant > >Secorvo Security Consulting GmbH >Ettlinger Strasse 12-14, D-76137 Karlsruhe >Tel. +49 721 255171-304, Fax +49 721 255171-100 >[email protected], http://www.secorvo.de/ >PGP: 87AE E858 CCBC C3A2 E633 D139 B0D9 212B > >Mannheim HRB 108319, Geschaeftsfuehrer: Dirk Fox > > -- Terry Roebuck Dept. of Computer Science http://www.cs.usask.ca/people/faculty.shtml University of Saskatchewan 306 966 2532 (office) 306 966 4884 (dept office) [email protected]