Mount a USB drive as Read Only in Windows XP

[lepricaun]

sorry irongeek, must have misread your question, i meant a flashdrive, and you mean a hdd connected via usb, my bad

but like the others say you must be able to "cut" the wire of the write option, i'll ask it at my work tomorrow, i'm sure someone would know which of the 40 pins you need...

[i2c]

SirDice - in the IDE specs youll notice that the wires that the signal is past along are also used for other tasks, so unfortunaltly its not a simple task of cutting them connections (dont think you were suggesting this though?)

there bared (NOT) so youd need to pull 1 high and the other low or both in same state to allow read/write. Like SirDice said a simple resistor is all that is needed. maybe instead of voiding your warrenty (yea i know thats more fun) you could go with a dongle type solution and just use an IDE extension cable and cut that up, im sure theres a ground on the IDE bus you can take advantage of. and an inverter will sort out the requirement for pulling something high if there isnt a 5v line on the IDE cable.

this is beating about the bush but ive mucked about with building one of these before (never finished it) to add datalogging to something.

http://members.lycos.co.uk/leeedavison/6502/ide/?

You might find it interesting to look at.

i2c

[Irongeek]

I’m bring up this old thread because it looks like I found the answer. This should work if you are running Windows XP SP2. Start regedit and open:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control

Then create a new key called StorageDevicePolicies. In that key create a new value called WriteProtect and set it to 1. All done, just mount your USB drive. Attached is a reg file you can merge.

[hogfly]

While I understand what you are trying to do, your methodolgy is a bit off.

To really prevent writes I wouldn't trust the windows registry. You are still going to modify the partition information by using the registry to control access. I'd strongly suggest you use linux as people have mentioned and then dd the drive to another disk or image. If you want to mount a drive as ready only in windows in a manner that guarantees you haven't modified anything, use a write blocker. You can get a firefly(for usb/firewire) for around $150. It's a cheap solution that will guarantee your work. There are also software write blockers that are available.

[Network Enforce]

i don't know if this will help, but I know that they have USB bridgeboards out there that are write protected specifically designed for forensics.

You can check it out here: http://fwdepot.com/thestore/default.php/cPath/26_95

Network Enforcer

[shroutosaur]

Buy yourself a writeblocker. Various manufacturers are out there. I've read reviews by other forensic examiners and they seem to like this one;

http://store.yahoo.com/cooldrives/usb20toatabr.html

Do a google on writeblockers and you should find others. I've heard of people monkeying around with the cable and they have had no success.

George
CCE, Security+

[Robertico]

XP SP2 can support a registry key to write protect USB block devices such as memory sticks.
It has been introduced to allow sys admins to block USB memory devices to prevent data theft.

I created a small systray utility for this (including reboot. Necessary for enabele write protection) called USB-Blocker.
Windows XP and Service Pack 2 detection included !!

Give it a try.

You can download a copy here .

For questions and/or comments mail me.

Greetings from the Netherlands.

Robert