Assume the following scenario:
You have to set up a machine in a way that a user is unable to bring out a certain set of files (or a single file only) from that machine while he has to be able to access the file on the machine itself.
The user has physical access to the machine when he is unobserved. He has no Admin privileges.
The machine runs Windows 7 and has built-in devices to read and write optical mediums as well as flash storage. It has USB ports, too, as well as a wireless network adapter.
There are however a lot of ways to gain that stuff if one truly wants to do it. Here is what I have listed so far:
- Uploading to a server. So i need to disallow any network access.
- Copying to a medium or booting another OS from one. I would have to disable all devices.
- Physically removing the hard disk. I would have to encrypt the device.
- Copying the file to the RAM, then freezing and moving it. I can not think of a solution.
Are there other methods of gaining a copy of the desired file? How can I fully prevent all the possible methods?
Footnote:
If you wonder why the heck anyone would like to do this: Due to the trust issues of my boss.