Mount USB drives as read-only in Windows #
via a quick registry edit (no reboot required - tested in XP SP2, 7 SP1, and 8.1). Simply save the following text as an .reg file and double click to merge:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies]
"WriteProtect"=dword:00000001
To restore mounting removable disks as read-write, just change "00000001" to "00000000", resave the file, and double click to merge. Not as sound as a hardware write blocker like the Forensic UltraDock, but might come in handy for less sensitive work.
More:
Updates:
- WinRegWriteBlocker "displays a specific systray icon depending on the state [of 'WriteProtect'] so you can directly determine if you're blocking USB devices of not."
- Reportedly, this setting only affects devices connected via USB, not eSATA or FireWire.
- Just stumbled onto SAFE Block, "a software-based write-blocker that facilitates the quick and safe acquisition and/or analysis of any disk or flash storage media attached directly to your Windows workstation. It is proven to be safe, significantly faster than hardware write-blocking solutions, and used across the globe by agencies, law enforcement, and private firms". Retails for $219 to $549, depending on Windows version. The licensing scheme is "single-instance use . . . machined-tied to one computer".
- DeepSpar has produced a video demonstrating a critical weakness with this method; namely, any process that accesses the drive outside of the Windows partition manager will bypass the block.
/windows | Feb 17, 2015
Subscribe or visit the archives.