Will setting up an installation on an SD card in this way prevent changes to the operating system?

Question

I want to set up an SBC, e.g. Raspberry Pi, Banana Pi, to work as close as possible to a computer running a Live Distro. I'm intending to use this to inspect suspicious or infected storage drives and view their contents. I'm not necessarily looking to do forensics on them (although if I did, I assume I can just apply these principles to a Kali installation). I'm aware that the Raspberry Pi is capable of botting from USB, so booting a Live CD should be possible, but I don't want to restrict my options to just the Raspberry Pi, so I want I'm considering the normal set up with these computers with the operating system on an SD card.

If I were to:

• mount all filesystems as read-only
• create and autologin to a non-root,non-privileged user
• remove root privileges from privileged users/delete privileged users
• completely disallow root login

Can I be confident that no malware compromising the system can make any permanent changes to it?

Answer 1

Can I be confident that no malware compromising the system can make any permanent changes to it?

No, you cannot. If malware was capable to compromise the system so that it is running as root, you cannot be sure about what happens to your USB.

The only way to be sure is to exclude modification on the hardware level. For instance, if you use CD-R or DVD-R, you can be sure they will not be modified.

Some SD cards have a physical switch to disable writing. As @Robert said: SD card only indicates that the SD card reader should not write. But there is no guarantee that the reader will follow that.

In all other cases you cannot be sure.

Answer 2

Some SBCs including the latest RPi version also come with an onboard EEPROM for storing parts of the boot code. In theory malware could also change this.