2

Speaking hypothetically, if a person wished to secure their data drives and a "writeblocker" device was of concern, could a piece of encryption software be crafted to write to the drive in question with a failure state locking the drive? Something like reading the device ID of the host PC and using it as part of the encryption key? Could this concept also be used to "hide" partitions of a drive with malicious code hidden inside, with the hidden partition only activating if the drive isn't blocked?

I was stumbling down a rabbit hole after looking into sandboxing a usb drive and didn't see anything specific about attempts to secure from "writeblocker" type devices.

Improve this question
1
  • I was thinking more along the lines of a self write action that would be required as part of the decryption process. So for example if I had stuff on a HDD that I didn't want getting out could an encryption method be devised where a write operation would be needed in order to decrypt the data? Where a failure to self-write would instead prevent the decryption from proceeding, I know this would likely just leave the person with a string of nonsense that could probably given enough time be decrypted anyway but I'm just wondering if this is even a possibility.
    – Séan Brown
    Feb 17 at 23:56

1 Answer 1

Reset to default
3

Typically, a write-blocking device intercepts commands sent to the device in whatever command set (NVME, ATA, SCSI, etc.) and only forwards those that don't involve writing to or modifying the contents of the disk. The forbidden commands merely fail with an error.

Oftentimes these tools are used for forensics. For example, it can be helpful to ensure that any malicious code (in a contained environment) that's run doesn't try to erase or modify itself, and if there's legal investigation, this can help avoid tampering with evidence.

If the write-blocking device is real and works correctly, then every attempt to write to the drive, regardless of what it is, will simply fail, and all read requests will be satisfied by the drive without modification. Of course, one can create a fake device that takes commands and does what you suggest, with some difficulty.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.