2

I am looking for a way to permanently lock an external hdd to read-only mode without a way for the external attacker to make it writable. If it is not possible to use a password or pin to make disk writable, I am ok with a permanent write-locking solution. The goal is to prevent unauthorised third-party from adding any files to the disk or modifying files on the disk and claiming that those files or their changes belong to me.

I know that DVD is a typical solution for this but I need to make 1TB to 2TB of data read-only, so DVDs are not an option.

Is there a way to physically write-lock hdd in any way? I am ok with using any hdd of any maker, either completely external or a 2.5 hdd that can be put into external enclosure. It is ok for me to cut something (like a wire). It just has to be either a password protected change (not OS dependent), or a complete hardware damage to write capability of the drive.

I searched both here and on the Internet in general but could not find the answer.

Edit: exclude password/pin, looking for a permanent solution to make the drive read-only.

|improve this question
  • Some clarification would be helpful - you say "looking for a way to permanently lock" but "[if pass/pin not possible], I am okay with a permanent write-locking solution." I get the impression that you want it non-reversibly locked against all users (or abusers) of the computer, but are okay with it being writable by you with physical access. Can you clarify your goal? – gowenfawr Nov 24 '18 at 18:51
  • It is for the case if somebody breaks in when I am not at home and tries to implant evidence against me on some of my disks. May be, password is not a good idea here because it can be stollen, viewed with a hidden camera, etc. So a permanent solution is what I would be looking for actually... – Unnamed_1 Nov 24 '18 at 19:04
  • You should edit the question to clarify that you're seeking to protect against physical attacks - at which point @JosephSible's assertion that there's no solution becomes much closer to true. – gowenfawr Nov 24 '18 at 19:07
  • 2
    What prevents the attacker to just swap whatever external device you use with a copy of it, containing other data, and then claim it's yours? I'm afraid this kind of threat model also includes the possibility that the attacker just puts a bloody knife under your bed and then claim you killed somebody. So your questions and the answers you got are interesting, but maybe they won't solve your real underlying problem. – reed Nov 24 '18 at 19:09
  • Well, there is always a way for an attacker to just put a completely new disk with some bad files on it and claim it is mine. Can't really fix that. But I want at least to protect truly my data from being changed/appended. – Unnamed_1 Nov 24 '18 at 19:17
1

What you're looking for is called a WORM drive (Write Once, Read Many). Historically, solutions in this space had more in common with tape drives than with hard drives, but there are some common products.

To quote from the literature for GreenTec, a vendor of one such implementation (emphasis mine):

WORMdisk™ technologies protect data from Ransomware, accidental or intentional modification, alteration, deletion or re-formatting with capacities ranging from 500 Gigabytes up to Multiple Petabytes. WORMdisks™ act like a one-way data diode where data can only be transferred one way, from the disk to the host (i.e. read-only) and cannot be transferred from the host to the disk media (i.e. written).

Protection is performed at the physical disk level, and is embedded in the disk drive itself, so it does not matter what operating system or access controls are placed on the disk, the data cannot be modified.

CD and DVD media are cheap options which can be used for this, but have limited capacities.

WORM solutions are relatively rare, and as such, generally more expensive per megabyte.

|improve this answer
  • You gave me an idea actually... Possibly M-Disk would be an option for me. It is more durable than a normal DVD and it can keep up to 100GB of data. And it is write once. – Unnamed_1 Nov 24 '18 at 19:01
  • That solves the "Y" of the asker's XY problem (I want my hard drive to become permanently read-only), but not the "X" (I don't want people to be able to claim I created files that I didn't), since an attacker with physical access could swap the WORM drive with a new one with arbitrary contents. – Joseph Sible-Reinstate Monica Nov 24 '18 at 20:34
0

What you want isn't possible. Imagine this scenario: you have such a write-protected drive with your data on it. An attacker buys another drive of the same model, copies your data into it, makes some changes, write-protects that one, then swaps the circuit boards (so the serial number looks unchanged) and leaves you the drive with the modified data.

No drives with such a feature exist, and even if they did, it wouldn't solve your problem because of the above. The only correct ways to prove authenticity of data are to use cryptographic MACs or digital signatures.

|improve this answer
  • But digital signatures can prove that something is yours, but can they prove that something isn't? – reed Nov 24 '18 at 15:51
  • As a side question, would disk encryption (for example Luks) help? I know disk encryption prevents an attacker from reading data, but I'm not sure how much it helps with preventing them from adding files or modify specific data. – reed Nov 24 '18 at 15:53
  • It all comes down to costs of faking it. My expected attacker most likely won't go that far. I expect they will drop the idea to fake something on disks as long as they can't put something there within 5 minutes. – Unnamed_1 Nov 24 '18 at 16:16
  • @reed you're right, signing can't prove that you didn't make something. Encryption would help, if a suitable mode of operation is used, in that the attacker could only corrupt/randomize data, not write arbitrary data of their choice. – Joseph Sible-Reinstate Monica Nov 24 '18 at 16:57
  • @JosephSible Encryption that makes data read-only is also ok but I did not see anything like that either... – Unnamed_1 Nov 24 '18 at 17:43
0

https://www.forensicswiki.org/wiki/Write_Blockers

Write blockers are devices that allow acquisition of information on a drive without creating the possibility of accidentally damaging the drive contents. They do this by allowing read commands to pass but by blocking write commands, hence their name.

|improve this answer
  • Those aren't permanent. Once you remove them from the drive, you can write to it again. – Joseph Sible-Reinstate Monica Nov 24 '18 at 16:55
  • Not a permanent solution, unfortunately. – Unnamed_1 Nov 24 '18 at 17:27
  • OP said he was "ok with a permanent [solution]", not requiring it, and that the attacker was external, so write blockers are a reasonable alternative. – gowenfawr Nov 24 '18 at 18:43
  • 1
    No, not reasonable because it makes too easy to modify data. Not ok. – Unnamed_1 Nov 25 '18 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.