As a followup to my recent post on backups, let’s say you use an external hard drive to make backups. If you’ve had some malware blow away your data on your local hard drive, you now want to be extremely careful while handling your backup copy. I certainly wouldn’t want to mount my external hard drive with the risk of malware deleting my only available backup (even if I were careful about cleaning up malware from my system). It would be comforting if I could flip a switch and make the external hard drive read-only after I’ve experienced data loss.
Back in the day, floppy disks had such a feature, and so did Zip disks. I wish this were a standard feature on external hard drives. And no, “mount as read-only” (which is a software solution) does not count.
Seems like those kind of switches are only available if the medium is technologically young. The first USB-Sticks had them, but nowadays this is rather seldom found. But, go and buy a patent on the first ever drive connector that plays man-in-the-middle and prevents all write-commands for ever reaching the disk. (I’d buy one.)
There is a paper about “Rootkit-Resistant Disks” at ACM CCS 2008 which uses different tokens to mark blocks as read-only during normal operation. These blocks can only be written again if the corresponding token is plugged into the disk.
While this is an interesting piece of research, I’m not sure whether some manufacturer will ever build this as product.
I couldn’t agree more with the content of this post. Heck, I’d even settle for a software solution at this point–for Windows, of course. It’d be a trivial problem for a real OS.
You have shed a ray of snhusine into the forum. Thanks!
Use a SD card they have the hardware read only switch and come in varieties up to about 32 GB, Also many USB drives have a hardware read only switch =)