Re: Converting an external hard drive enclosure into a write blocker?
Matthew Pepe <[email protected]> Sat, 24 Nov 2007 20:23:59 -0500
| Newsgroups | gmane.comp.security.forensics |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail-41-750793818 Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit The easiest thing to do is to use a bridge whose firmware can be modified to take a different action upon the issuance of a write (or write-related) command. Operating systems will react differently depending upon whether the device returns an error code, success code, or remains quiet. The bottom line is that you need to intercept packetized commands - write enable is not based off of a pin pulled high or low. For more information, check out the ATA/ATAPI5 documents from the T13 working group. - Matt On Nov 20, 2007, at 11:11 AM, Terry Roebuck wrote: > A*nix mount with DD would be my option of choice, but for windows, I > hesitatingly ask could you not modify an IDE cable to make any > connected drive 'read-only' (might require a resistor - not sure if > you can just clip a wire? - maybe some one with better EE skills > could answer that?) --Apple-Mail-41-750793818 Content-Disposition: attachment; filename=smime.p7s Content-Type: application/pkcs7-signature; name=smime.p7s Content-Transfer-Encoding: base64 MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGHTCCAtYw ggI/oAMCAQICECmGuaYtXFQ1wvH8HREuv38wDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkEx JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA3MTEwMTIyMzMyN1oXDTA4MTAzMTIyMzMy N1owQDEfMB0GA1UEAxMWVGhhd3RlIEZyZWVtYWlsIE1lbWJlcjEdMBsGCSqGSIb3DQEJARYObXRw ZXBlQG1hYy5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCX6YBod68T8xZhENBX lQ7dvoPvUKqzYc+DV5mIWevfJ0IgGG9uZ8DB5ZZ8vVcHC5JN9dhLn1VIGjYrBszUnoZjIIu54Boe zlBCxciuCbpoMAxdejbWkl91wTQP09CfEUAXz7cSQlJmN2SQPifGmFtfo1x6crO0SJy7ZeMCpGhr 5RxVstmN1yN8CQ7mxF3V4/LcfKhFQ8AAwGw+otwcBjDoUnBuJZE82IggUOFIRJGj7KYYzrFfjdvL yKL2sHDeTR+2HABOnc8SL/a5uT7Z53YNxE1Vu8yJITowjyAfFJ8/IX3Dc0rWz441puFBFXbT1S0m 3JbFNsvUyGylnnGO9tRvAgMBAAGjKzApMBkGA1UdEQQSMBCBDm10cGVwZUBtYWMuY29tMAwGA1Ud EwEB/wQCMAAwDQYJKoZIhvcNAQEFBQADgYEAVQlgPvmefoRM6upnQNRoggzJj9pltirjJw81EOe5 9MYKGHcpPcBt7PXgUtQ+r1RTk4I2gHnT9wzYDvYJheh5W75re4swXoqxistDQ2frK5nexaHc65XD XwWXWhK9qE2DjvHeWpgOkBEEQTDCemEjRkXAYp6+/bJVuAOMJCybwQIwggM/MIICqKADAgECAgEN MA0GCSqGSIb3DQEBBQUAMIHRMQswCQYDVQQGEwJaQTEVMBMGA1UECBMMV2VzdGVybiBDYXBlMRIw EAYDVQQHEwlDYXBlIFRvd24xGjAYBgNVBAoTEVRoYXd0ZSBDb25zdWx0aW5nMSgwJgYDVQQLEx9D ZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMSQwIgYDVQQDExtUaGF3dGUgUGVyc29uYWwg RnJlZW1haWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFsLWZyZWVtYWlsQHRoYXd0ZS5jb20w HhcNMDMwNzE3MDAwMDAwWhcNMTMwNzE2MjM1OTU5WjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMc VGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZy ZWVtYWlsIElzc3VpbmcgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMSmPFVzVftOucqZ Wh5owHUEcJ3f6f+jHuy9zfVb8hp2vX8MOmHyv1HOAdTlUAow1wJjWiyJFXCO3cnwK4Vaqj9xVsuv PAsH5/EfkTYkKhPPK9Xzgnc9A74r/rsYPge/QIACZNenprufZdHFKlSFD0gEf6e20TxhBEAeZBly YLf7AgMBAAGjgZQwgZEwEgYDVR0TAQH/BAgwBgEB/wIBADBDBgNVHR8EPDA6MDigNqA0hjJodHRw Oi8vY3JsLnRoYXd0ZS5jb20vVGhhd3RlUGVyc29uYWxGcmVlbWFpbENBLmNybDALBgNVHQ8EBAMC AQYwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVByaXZhdGVMYWJlbDItMTM4MA0GCSqGSIb3DQEB BQUAA4GBAEiM0VCD6gsuzA2jZqxnD3+vrL7CF6FDlpSdf0whuPg2H6otnzYvwPQcUCCTcDz9reFh YsPZOhl+hLGZGwDFGguCdJ4lUJRix9sncVcljd2pnDmOjCBPZV+V2vf3h9bGCE6u9uo05RAaWzVN d+NWIXiC3CEZNd4ksdMdRv9dX2VPMYIDEDCCAwwCAQEwdjBiMQswCQYDVQQGEwJaQTElMCMGA1UE ChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFs IEZyZWVtYWlsIElzc3VpbmcgQ0ECECmGuaYtXFQ1wvH8HREuv38wCQYFKw4DAhoFAKCCAW8wGAYJ KoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDcxMTI1MDEyMzYwWjAjBgkq hkiG9w0BCQQxFgQUzKRZUx0DyhInPS6+4T/kT4e+qEswgYUGCSsGAQQBgjcQBDF4MHYwYjELMAkG A1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMT I1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAhAphrmmLVxUNcLx/B0RLr9/MIGH BgsqhkiG9w0BCRACCzF4oHYwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0 aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5n IENBAhAphrmmLVxUNcLx/B0RLr9/MA0GCSqGSIb3DQEBAQUABIIBAIeVyJ1y7G/1ydBRVRmpI4CW 5PuC0M7dQq4V2QP6oYpVmvWnSmwTcMfHRf5S19fhIMcbgrJ2Sk3Y1ckm+cpR1SrJzATFuB62IWx0 ztxL3uFhepClDcDePLXeKVmOtQf6GQZvydiJnjccdaCI/BnQRFsON1Z1n0ssMjfDEO1PzNupP876 S3An6EKXM0C/h+9uJcrNDpnkZotBri3OElweV8rUyGYuC8RJE1oitxuUqsQzVB4IlVy3quhETVGo MkkjHkAiNva+V6O3dFWNlm+g/bb6Zj2XdotZ9See3CvBXpNIvdE5SU2g4Rv3RU3rTnqNYuNHd6GX 0eiO6gG6wjQmd7YAAAAAAAA= --Apple-Mail-41-750793818--