Re: Converting an external hard drive enclosure into a write blocker?

Matthew Pepe <[email protected]> Sat, 24 Nov 2007 20:23:59 -0500
Newsgroups gmane.comp.security.forensics
Message-ID <[email protected]>
--Apple-Mail-41-750793818
Content-Type: text/plain;
	charset=US-ASCII;
	format=flowed;
	delsp=yes
Content-Transfer-Encoding: 7bit

The easiest thing to do is to use a bridge whose firmware can be  
modified to take a different action upon the issuance of a write (or  
write-related) command.  Operating systems will react differently  
depending upon whether the device returns an error code, success code,  
or remains quiet.  The bottom line is that you need to intercept  
packetized commands - write enable is not based off of a pin pulled  
high or low. For more information, check out the ATA/ATAPI5 documents  
from the T13 working group.

- Matt


On Nov 20, 2007, at 11:11 AM, Terry Roebuck wrote:

> A*nix mount with DD would be my option of choice, but for windows, I  
> hesitatingly ask could you not modify an IDE cable to make any  
> connected drive 'read-only' (might require a resistor - not sure if  
> you can just clip a wire? - maybe some one with better EE skills  
> could answer that?)


--Apple-Mail-41-750793818
Content-Disposition: attachment;
	filename=smime.p7s
Content-Type: application/pkcs7-signature;
	name=smime.p7s
Content-Transfer-Encoding: base64

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGHTCCAtYw
ggI/oAMCAQICECmGuaYtXFQ1wvH8HREuv38wDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkEx
JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ
ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA3MTEwMTIyMzMyN1oXDTA4MTAzMTIyMzMy
N1owQDEfMB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEdMBsGCSqGSIb3DQEJARYObXRw
ZXBlQG1hYy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCX6YBod68T8xZhENBX
lQ7dvoPvUKqzYc+DV5mIWevfJ0IgGG9uZ8DB5ZZ8vVcHC5JN9dhLn1VIGjYrBszUnoZjIIu54Boe
zlBCxciuCbpoMAxdejbWkl91wTQP09CfEUAXz7cSQlJmN2SQPifGmFtfo1x6crO0SJy7ZeMCpGhr
5RxVstmN1yN8CQ7mxF3V4/LcfKhFQ8AAwGw+otwcBjDoUnBuJZE82IggUOFIRJGj7KYYzrFfjdvL
yKL2sHDeTR+2HABOnc8SL/a5uT7Z53YNxE1Vu8yJITowjyAfFJ8/IX3Dc0rWz441puFBFXbT1S0m
3JbFNsvUyGylnnGO9tRvAgMBAAGjKzApMBkGA1UdEQQSMBCBDm10cGVwZUBtYWMuY29tMAwGA1Ud
EwEB/wQCMAAwDQYJKoZIhvcNAQEFBQADgYEAVQlgPvmefoRM6upnQNRoggzJj9pltirjJw81EOe5
9MYKGHcpPcBt7PXgUtQ+r1RTk4I2gHnT9wzYDvYJheh5W75re4swXoqxistDQ2frK5nexaHc65XD
XwWXWhK9qE2DjvHeWpgOkBEEQTDCemEjRkXAYp6+/bJVuAOMJCybwQIwggM/MIICqKADAgECAgEN
MA0GCSqGSIb3DQEBBQUAMIHRMQswCQYDVQQGEwJaQTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIw
EAYDVQQHEwlDYXBlIFRvd24xGjAYBgNVBAoTEVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9D
ZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMSQwIgYDVQQDExtUaGF3dGUgUGVyc29uYWwg
RnJlZW1haWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFsLWZyZWVtYWlsQHRoYXd0ZS5jb20w
HhcNMDMwNzE3MDAwMDAwWhcNMTMwNzE2MjM1OTU5WjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMc
VGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZy
ZWVtYWlsIElzc3VpbmcgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMSmPFVzVftOucqZ
Wh5owHUEcJ3f6f+jHuy9zfVb8hp2vX8MOmHyv1HOAdTlUAow1wJjWiyJFXCO3cnwK4Vaqj9xVsuv
PAsH5/EfkTYkKhPPK9Xzgnc9A74r/rsYPge/QIACZNenprufZdHFKlSFD0gEf6e20TxhBEAeZBly
YLf7AgMBAAGjgZQwgZEwEgYDVR0TAQH/BAgwBgEB/wIBADBDBgNVHR8EPDA6MDigNqA0hjJodHRw
Oi8vY3JsLnRoYXd0ZS5jb20vVGhhd3RlUGVyc29uYWxGcmVlbWFpbENBLmNybDALBgNVHQ8EBAMC
AQYwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVByaXZhdGVMYWJlbDItMTM4MA0GCSqGSIb3DQEB
BQUAA4GBAEiM0VCD6gsuzA2jZqxnD3+vrL7CF6FDlpSdf0whuPg2H6otnzYvwPQcUCCTcDz9reFh
YsPZOhl+hLGZGwDFGguCdJ4lUJRix9sncVcljd2pnDmOjCBPZV+V2vf3h9bGCE6u9uo05RAaWzVN
d+NWIXiC3CEZNd4ksdMdRv9dX2VPMYIDEDCCAwwCAQEwdjBiMQswCQYDVQQGEwJaQTElMCMGA1UE
ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFs
IEZyZWVtYWlsIElzc3VpbmcgQ0ECECmGuaYtXFQ1wvH8HREuv38wCQYFKw4DAhoFAKCCAW8wGAYJ
KoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDcxMTI1MDEyMzYwWjAjBgkq
hkiG9w0BCQQxFgQUzKRZUx0DyhInPS6+4T/kT4e+qEswgYUGCSsGAQQBgjcQBDF4MHYwYjELMAkG
A1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMT
I1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAhAphrmmLVxUNcLx/B0RLr9/MIGH
BgsqhkiG9w0BCRACCzF4oHYwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0
aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5n
IENBAhAphrmmLVxUNcLx/B0RLr9/MA0GCSqGSIb3DQEBAQUABIIBAIeVyJ1y7G/1ydBRVRmpI4CW
5PuC0M7dQq4V2QP6oYpVmvWnSmwTcMfHRf5S19fhIMcbgrJ2Sk3Y1ckm+cpR1SrJzATFuB62IWx0
ztxL3uFhepClDcDePLXeKVmOtQf6GQZvydiJnjccdaCI/BnQRFsON1Z1n0ssMjfDEO1PzNupP876
S3An6EKXM0C/h+9uJcrNDpnkZotBri3OElweV8rUyGYuC8RJE1oitxuUqsQzVB4IlVy3quhETVGo
MkkjHkAiNva+V6O3dFWNlm+g/bb6Zj2XdotZ9See3CvBXpNIvdE5SU2g4Rv3RU3rTnqNYuNHd6GX
0eiO6gG6wjQmd7YAAAAAAAA=

--Apple-Mail-41-750793818--