9

This question already has an answer here:

I see lots of articles about preventing a specific computer from writing to a USB flash drive or preventing malware from getting from a USB flash drive to a computer; what I can’t find anything for is how to prevent any system from writing to a USB flash drive.

I work at an I.T. help desk and as such I work with some devices that have some form of malware. From simple adware, to more advanced kinds of infections it varies. I have a USB flash drive with a bunch of tools I use day to day to fix some of the more common issues. I want to lock this USB flash drive down and prevent it from being modified. I know some viruses will try to infect a USB device, and this is exactly what I want to avoid. I don’t want to use a USB flash drive on one users computer and then plug it into the next ones and infect them.

Is there an effective method—that is OS independent—to prevent a USB flash drive from being written to? I could use a disc to do this, and use a USB powered disc drive where optical drives are not present in the laptop, however this is not as convenient of a method, so I’d prefer to use a USB flash drive if possible.

marked as duplicate by Peter Mortensen, fixer1234, DavidPostill, mdpc, Nifle Mar 17 '15 at 6:32

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    You say, “USB drive” and “USB device” but you never say, “USB flash drive.” I assume you mean USB flash drive, but just adding a comment to make sure. – JakeGould Mar 12 '15 at 23:17
  • 1
    @JakeGould yes, I do mean flash drive. – ComputerLocus Mar 12 '15 at 23:25
  • this question on security.stackexchange seems related – Silveri Mar 13 '15 at 7:24
  • Everyone is clueless... this can be done with the oem tools leaked all over the internet... – Hydranix May 5 '17 at 8:34
14

Is there an effective method that is OS independent to prevent a USB from being written to?

Not really unless you are using a device that explicitly uses a forensic write blocker/controller or something similar that blocks data writes on a controller level.

Read and write permissions/restrictions on the vast majority of devices out there are inherently, physically read and write capable—like USB flash drives—is a logical OS-based construct. When something gains malicious access to a device, it simply doesn’t care about such circumventable logical restrictions. Remember: Code—such as viruses and malware—that can infect a system will basically operate on “root”/“admin” level at all times and can just do whatever it wants.

So even those SD cards that have those little write-protect switches are fairly useless since anything that gains deep system access can just ignore that “don’t write to me” setting. For example, look over this list of various ways to disable/circumvent write protection to SD cards on various systems; a simple adjustment to registry settings for StorageDevicePolicies from 1 to 0 in Windows will essentially tell the system to ignore the write-protect switch.

This kind of “hack” is no deep secret and even openly discussed/advocated by Microsoft support—such as in this official support thread—when providing support to users who have legitimate reasons to bypass write protection on USB devices.

Your best bet—if preventing unauthorized write access is a goal—is to use media that physically blocks write access like CD-R’s or DVD-R’s after they are burned.

I could use a disc to do this, and use a USB powered disc drive where optical drives are not present in the laptop, however this is not as convenient of a method, so I’d prefer to use a USB flash drive if possible.

Honestly, the use of truly read only media—like a burned CD-R or DVD-R—is the only simple and practical way to ensure malicious writing access is stopped at a deeper level. It might seem inconvenient, but the way I would approach this is simple:

  • CD-R/DVD-R Master of Tools: Create a CD-R/DVD-R with all the tools on need on it. Use that as the master. Maybe burn a few copies to have as backups.

  • Create a USB version of the CD-R/DVD-R Master: Now with that CD-R/DVD-R created, create an exact clone of the contents of that CD-R/DVD-R on a USB flash drive. The logic being that you can use this USB flash drive daily and if somehow it chokes or gets infected, you can then “downgrade” to the CD-R/DVD-R.

Now all that said, there is such a thing as a forensic write blocker/controller. These devices mainly provide an interface between a SATA or IDE drive and a USB connection that will allow one to mount and access a SATA or IDE drive without risk of data being written to it. And as the term “forensics” implies, these devices are mainly intended for legal and/or law enforcement purposes to ensure that a device in a “chain of custody” cannot be tampered with.

So if a “bad guy” is arrested, law enforcement might take their laptop, remove the hard drive and connect it to a forensic write blocker/controller to gather evidence for whatever purpose they need in a way that assures the courts and others that the data was not tampered with.

That said, these forensic write blocker/controller devices are not cheap—they run around $200 to $300 (U.S. dollars)—and mainly have interfaces that are USB to SATA or IDE; not USB to USB. But wait! I was able to find this “ToughTech m3” enclosure that claims to have a “Unique WriteProtect read-only mode”:

It features a unique WriteProtect read-only mode that "locks down" your data and prevents someone from accidentally deleting or modifying it. This is a handy way to protect your drive when loaning it to a client or someone else to distribute files or data.

A quick search online shows that this enclosure can be had for less than $50 (U.S. dollars). And if it does what it claims—in the same manner a forensic write blocker/controller works—then this could be a good investment for someone like you. But I have no direct experience with this device so I cannot speak for it’s true ability to protect data from inadvertent/accidental/unauthorized write access.

  • And is there an effective method to determine if a USB flash drive has been infected? – ComputerLocus Mar 12 '15 at 23:28
  • @Fogest The only effective way to check if a USB flash drive is infected is via malware/virus detection and removal tools. But that is a whole other concept and question. Just be sure the systems you use the USB flash drive on have protection that scans the USB flash drive or make sure to scan for malware/viruses when you head back to your desk. – JakeGould Mar 12 '15 at 23:30
  • 3
    More than that, the physical switch on most SD cards isn't electrically connected to anything. It's literally a little piece of plastic that the hardware can optionally detect and respond to, often with an optical sensor. Some readers don't have that sensor (e.g. the lock detection of the reader on a Raspberry Pi isn't connected to anything on the PCB side). – Bob Mar 13 '15 at 6:23
  • 1
    I learn new things everyday, and today it's about the write-protect switch on SD cards... – h.j.k. Mar 13 '15 at 7:34
  • 1
    @Fogest It wouldn't be a bad idea to reformat and re-image after every use except that humans forget! Once in a while you'll absent mindedly forget to re-image and then you have a disaster. – curious_cat Mar 13 '15 at 11:05
11

Is there an effective method—that is OS independent—to prevent a USB flash drive from being written to ?

Yes, there are a few.

  • You can use a forensic USB write blocker such as this one:

enter image description here

From the product description:

The compact USB WriteBlocker connects to USB storage devices and protects their contents during an investigation. To use, simply connect the WriteBlocker to the suspect device.

The USB WriteBlocker connects to most USB storage devices: USB thumb drives, digital cameras, cell phones, or most anything with a USB connection.

  • Some USB flash drives have physical write-protection switches (Important: Many devices will have "logical" switches that can be bypassed by the software, read @JakeGould's excellent answer for more in-depth info):

enter image description here

  • Some IDE/SATA-to-USB adapters have write-disable locks:

enter image description here

Not the answer you're looking for? Browse other questions tagged or ask your own question.