Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies] "WriteProtect"=dword:00000001To restore mounting removable disks as read-write, just change "00000001" to "00000000", resave the file, and double click to merge. Not as sound as a hardware write blocker like the Forensic UltraDock, but might come in handy for less sensitive work.
Quickly and Easily Setting USB Drives to Read Only in Windows 7
How to mount an NTFS partition read-only in Windows? (lengthier method using mountvol.exe and diskpart.exe)
ProUSB - An AutoHotkey script to enable or disable auto-mounting of removable disks, including an option to mount as read-only/write-protected
OS X: Mount disks as read only or block automounting altogether
The Fallacy of Software Write Protection in Computer Forensics
Updates:
WinRegWriteBlocker "displays a specific systray icon depending on the state [of 'WriteProtect'] so you can directly determine if you're blocking USB devices of not."
Reportedly, this setting only affects devices connected via USB, not eSATA or FireWire.
Just stumbled onto SAFE Block, "a software-based write-blocker that facilitates the quick and safe acquisition and/or analysis of any disk or flash storage media attached directly to your Windows workstation. It is proven to be safe, significantly faster than hardware write-blocking solutions, and used across the globe by agencies, law enforcement, and private firms". Retails for $219 to $549, depending on Windows version. The licensing scheme is "single-instance use . . . machined-tied to one computer".
DeepSpar has produced a video demonstrating a critical weakness with this method; namely, any process that accesses the drive outside of the Windows partition manager will bypass the block.
Via gpedit.msc: Local Computer Policy → Computer Configuration → Administrative Templates → System → Removable Storage Access → set "Removable Disks: Deny write access" to Enabled.
/windows | Feb 17, 2015