4

Has anyone come across a 2.5 SSD or HDD that has a physical read-only switch similar to this? Or an enclosure that can render a hard drive read only?

5
  • 1
    As mgjk answered what it sounds like you're looking for is a forensic write-blocker like this one.
    – Xander
    Commented Nov 4, 2014 at 14:42
  • @Xander Perhaps I should have elaborated on my intentions in the question. While that is certainly interesting from a forensics analysis standpoint, and definitely something I want to look into a bit more. This specific question is dealing with hardening a hard drive to prevent it from being exploited by a malware contaminated system or to create a read only operating system that runs in RAM.
    – P0LYmath
    Commented Nov 4, 2014 at 15:47
  • 1
    So booting from a CD will be good enough? Linux Live CDs have been a poor man's read only OS for write some time.
    – ewanm89
    Commented Nov 4, 2014 at 18:03
  • @ewanm89 I've thought of that same solution, and while cost saving there are 2 reasons it's not what I need. 1: A CD would prevent me from making future modifications to the drive. 2: My image will include a large database of information that could potentially exceed the limits of even a DVDR. And if it were simply a matter of having a read only image, I could have used the Thumb drive I mentioned in the beginning (and still had a large capacity of storage). The solution needs to be high capacity, and portable, with the ability to be expanded.
    – P0LYmath
    Commented Nov 4, 2014 at 18:36
  • I updated my answer with something I didn't think about. Commented Nov 6, 2014 at 16:40

2 Answers 2

2

It sounds like you're looking for a "Hardware Write Blocker" http://www.forensicswiki.org/wiki/Write_Blockers

It's important to know why you need it. There are cheapish ones out there that probably work fine. Search for "Hardware Write Blocker Enclosure". Stuff comes up, eg.., http://www.digitalintelligence.com/cart/ComputerForensicsProducts/3.5-Inch-USB3-Hard-Drive-Enclosure-WRITE-BLOCKER.html It probably works fine.

For legal and military applications (Cameron can correct me if I'm wrong) evaluation, selection, procurement and custody is controlled for these kinds of devices. I.e., they work because people qualified and responsible for ensuring they work say they work. Money isn't much of an issue with that kind of thing.

For normal people, money is an issue. Following the forensic and military leads on this information is probably the best we can do.

1
  • Forensic hardware write blockers aren't actually all that expensive. They're on the order of a few hundred dollars for the nice-ish ones I've looked at.
    – Xander
    Commented Nov 4, 2014 at 14:35
1

What you are looking for normally found in DOD or other high data sec level environments, http://www.army-technology.com/contractors/data_recording/innodisk-corporation/innodisk-corporation2.html this what I have seen used at our facilities. We have Strict HIPPA regulations and use these for the archive storage.

Enclosed HDD is not a great solution. The read only protection is proprietary and has the potential to be compromised, it would not be hard to bypass the enclosure. Onboard protection directly on the drive will have a smaller threat index.

UPDATE:

As I was looking over this issue again I realized there far more simplistic alternative that requires little investment or overhaul of the current infrastructure. That solution is disk level encryption. Sophos is a perfect encryption utility that allows for the disk level security as well as a read only policy that prohibits data from being extracted from the disks or only allow read capability. The read only is set up from the software level and is not hindered if zed in a webserver environment.

Its all about what you are looking to achieve. But when it comes to threat management you should always assess what are you protecting, and who are you protecting it from.

2
  • I'm curious, the hard drive you mentioned doesn't really elaborate on how the write protection works. Am I correct to assume it is a physical switch? Some sort of mechanical function that moves the contacts out of line? Or is it a software solution? If it's a mechanical solution, then I don't see how this would be much different than an enclosure that could do the same.
    – P0LYmath
    Commented Nov 4, 2014 at 13:19
  • Actually the security functions are built in meaning its controlled on he board. The access to the security functions is software controlled. Could that be overwritten and hacked to allow one access to the HDD? Possibly but not worth the time since there is encrypted counter measurements. Commented Nov 6, 2014 at 16:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .