RE: Converting an external hard drive enclosure into a write blocker?
"Robinson, Sonja" <[email protected]> Mon, 26 Nov 2007 16:13:03 -0500
| Newsgroups | gmane.comp.security.forensics |
|---|---|
| Message-ID | <[email protected]> |
Tableau makes good write blockers for many different types of connections.=20 -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Matthew Pepe Sent: Saturday, November 24, 2007 8:24 PM To: Terry Roebuck Cc: [email protected] Subject: Re: Converting an external hard drive enclosure into a write blocker? The easiest thing to do is to use a bridge whose firmware can be modified to take a different action upon the issuance of a write (or write-related) command. Operating systems will react differently depending upon whether the device returns an error code, success code, or remains quiet. The bottom line is that you need to intercept packetized commands - write enable is not based off of a pin pulled high or low. For more information, check out the ATA/ATAPI5 documents from the T13 working group. - Matt On Nov 20, 2007, at 11:11 AM, Terry Roebuck wrote: > A*nix mount with DD would be my option of choice, but for windows, I=20 > hesitatingly ask could you not modify an IDE cable to make any=20 > connected drive 'read-only' (might require a resistor - not sure if=20 > you can just clip a wire? - maybe some one with better EE skills could > answer that?)