Flash drive virus protection

[Darksnake]

I bought a flashdrive with a write protect switch for the same reason. I currently have a 2gb version from pqi. They have 4gb ones as well but didnt have them in stock at the time i ordered mine.
As a side note, there are some worms that can still infect your flash drive even with the write protect switch set. I found this out the hard way with brontok and/or the rjump worm. Nasty lil buggers, took me 2 months to fully clean them out of my work place.

[nihil]

The answer is "yes it can" and a good "how to" is here:

http://www.ntfs.com/quest22.htm

However, I wouldn't recommend it if you use Win XP as strange and undesirable things can happen, particularly if you are moving it from one machine to another.


You must remove the drive using the "Safely Remove Hardware" option. Otherwise you run the risk of losing cached information that has not been written to the drive and even corrupting the drive itself.

I know there are manufacturers that suggest that you don't have to do this, but please remember that they supplied you with a drive formatted as FAT and the optimisation set to quick removal

Also, NTFS will probably give you less working space and, as it is a journaling file system it will cause more write activity.

Again Fat16/32 is much more operating system compatible than NTFS which may or may not be an issue?

[GPF]

OK, giving the NTFS thing a try. I found that after you formatted the drive NTFS you can then change the policy back to optimize for quick removal and still leave it NTFS formatted so that might solve that problem.

[jockey0109]

Oh well, nihil is right.

I am a Linux user and seldom use Windows now. Now let me tell you a very interesting but unfortunate thing that happened to me just yesterday. I have got an external HDD in which I have a NTFS partition amongst other 3 FAT32 ones. I mounted the drive on Windows OS just to delete some data from the disk.

I forgot to unmount it and issued the shutdown command to Windows. Now, while it displayed the message "Windows is shutting down..." on the welcome screen, I plugged out the USB cable from the port. Just 1 second later a dialogue box titled 'delayed write failed came in saying Windows was unable to save the contents of the file J:\$MFT (this actually is the MASTER FILE TABLE (just for those who did not know)) properly. This might have caused data loss. Please save the file elsewhere.

And yes, it had failed. The MFT was not changed and the file that I had deleted was not deleted. It was still there.

Now there are two things:

1. It would be a BAD IDEA to format a USB drive as NTFS file system specially when u have some precious data as both undeleted and deleted data (by mistake) may create a lot of problem.

2. And the second issue is: IS WINDOWS really so slow or the NTFS MFT manipulation is so complex that it would take more than 25 seconds to just modify the MFT of a NTFS formatted drive with a moderate size and moderate number of files.

[GPF]

OK Guys, thank you all so much for your help. Using NTFS permissions is doing exactly what I need so consider this question answered.

[GPF]

Now there are two things:

1. It would be a BAD IDEA to format a USB drive as NTFS file system specially when u have some precious data as both undeleted and deleted data (by mistake) may create a lot of problem

2. And the second issue is: IS WINDOWS really so slow or the NTFS MFT manipulation is so complex that it would take more than 25 seconds to just modify the MFT of a NTFS formatted drive with a moderate size and moderate number of files.

OK in response to #1 The data on this flash drive is not precious, it's mostly technical tools that I have copies of.

Secondly as I said before. Once the drive has been formatted NTFS you can then set it back to "Optimize for quick removal" and as such data corruption is much less likely.

[nihil]

Woha there, big fellah!

Secondly as I said before. Once the drive has been formatted NTFS you can then set it back to "Optimize for quick removal" and as such data corruption is much less likely.

Actually that will almost guarantee data corruption and possibly rendering the flash drive unusable

NTFS does not support quick removal because of its journaling and caching. You may get away with it for a while, but sooner or later you will kill your flashdrive.

Just ask yourself one question: "Why did I have to change the policy from quick removal to even get it to format in NTFS?" there was a reason

EDIT:

Consider also, what the USB "quick removal" feature was designed for?

It was aimed at on the fly connection and disconnection of HIDs and the like..........that is mice, keyboards, scanners, modems, etc. Latterly we have external memory devices, printers, cameras...............my basic rule of thumb is that if the device has memory you should dismount it properly, particularly in an NTFS environment.

[GPF]

Ok I get what you are saying but the only thing that I can figure could go wrong is if you remove it during a data transaction because that would mess with the MFT and transaction log. I intend to use safe removal anyway, I usually always do. There may be other things that could go wrong, but I can't figure anything that could not be fixed by a format and like I said the data is not critical. I'll keep using it and report back here every so often. Also I checked, if the flash drive is rendered unusable then I'll get swapped out under warranty as the warranty booklet says nothing about not formatting the drive NTFS.

[nihil]

Hi GPF,

I have just done a bit of experimenting:

2 x USB cameras
2 x USB mice
2 X USB flash drives (FAT)
1 USB joystick
2 x ADSL dial-up modems

1 x XP SP2 fully patched
1 x Windows 2000 SP4 fully patched

Latest BIOS on both.

The "Safely Remove Hardware" icon in the system tray brings up a list of devices. It recognises the cameras, modems and the flash drives, but not the mice or the joystick.

My recommendation is that it would be prudent to always use the safely remove hardware for any item that appears on that list.

You would probably be OK as far as your data are concerned, as you are effectively using the drive in read only mode anyway.

I would certainly reset your device from the quick remove mode as NTFS and its operating systems do not understand that too well.

Based on drives that customers have brought to me there is an issue with NTFS and also with Win 2000/XP. What seems to happen is the MBR becomes corrupted (remember the MFT is only a part of the MBR) and the system doesn't recognise the device anymore.

Once this happens you cannot reformat the drive. Anyway, reformatting won't affect the corrupted MBR. You can get the data recovered from these drives, but I don't have the equipment and software to do it.

The reason that I also suspect the OS is that sometimes I can get the device to be recognised on one of my machines. And, quite a few of the drives I have seen this happen to were "as bought," so would have a FAT file system.

There is also the issue of some older (Dell) machines appearing to develop a "memory" such that a certain USB device will only work on a certain port. I must admit I have never figured that one out

[GPF]

Please correct me if I am mistaken, but if the MBR becomes corrupt only the volume (disk portion) of the drive would be inaccessible right? If this is the case then MBR rebuild software would fix it... right? If that is the case then there is actually free software available that can do this. eg. http://www.safe-install.com/programs...-undelete.html
What do you think?