2

A friend told me about a hardware piece which protects the hard drive from saving changes made to it, so that when the computer is rebooted it remains the same as it was the last time. Does such a thing exist?

4

Yes, it's called a write-blocker, or more officially a "forensic disk controller". The hardware doesn't cache any writes; it simply mounts the disk as completely read-only, with no physical way to write data to the disk.

If what you're looking for is a way to run an OS more traditionally with write capabilities, but restoring to a previous state after you reboot, then the best way to do that is with a live CD image. Alternatively you could set up a VM on read only storage, then boot into that. This could be done with read-only media like a CD or DVD, or with writeable storage through a write-blocker, or with a storage device which has a physical read-only switch.

1

While @Polynomial's answer is correct, I think what you are looking for is actually software-based. Companies such as Faronics make products (like Deep Freeze) that do not store changes to the disk once the disk is frozen. You need to reboot into a thawed mode to make any changes that you want persisted between reboots, otherwise any changes made to the OS / filesystem are purged during reboot.

Companies like Apple use products like this on their demo systems in the store and simply reboot the machines each night to return to the intended configuration.

  • 1
    Keep in mind that these systems are NOT secure against intentional tampering. I have repeatedly broken these systems, even given nothing more than normal tools on a locked-down corporate OS build, as a non-administrative user. This includes Deep Freeze, Time Freeze, HDGUARD, Restore RX, and a bunch of others that I have forgotten about over the years. If you're looking to protect yourself from malware infection or malicious compromise by limiting the window in which the intrusion persists, software isn't a safe option. Nonvolatile storage (e.g. live CD + ramdisk) is much safer. – Polynomial Sep 22 '16 at 21:25
  • What I'm looking for is something like this, except hardware based instead of software based. – Ploni Sep 22 '16 at 21:40
  • I think booting a fresh version of the ISO (read: live boot) as @Polynomial describes may be your best bet. I don't know if you can live boot from a write-blocked device though. You may, I've just never tried it. Only ever used them for forensic purposes. @Polynomial? – HashHazard Sep 22 '16 at 23:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.