USB drives have completely replaced CDs and floppies. Most of the users prefer to use USB drive as it is available at cheap price with high storage capacity. USB drives are also becoming medium of spreading of viruses and worms due to auto run functionally of Windows.
Also when you connect your clean USB drive to infect machine your USB drive may get infected and subsequently infecting all the machines on which this USB drive is used. One way to protect and prevent virus spreading via USB drive is by disabling USB drive write meaning making it “read only”.
By default Windows doesn’t provide any option to Write Protect USB drives and you need to edit Windows registry to achieve this. To make it easier for you here is third party freeware tool Thumbscrew.
Thumbscrew allows you to quickly enable or disable writing to all USB mass storage devices on your Windows system. In other words you can use it to make a USB flash drive, hard drive or IDE / SATA drive in an enclosure read only.
Thumbscrew is my attempt at a poor man's USB write blocker. When used it allows you to quickly enable or disable writing to all USB mass storage devices on your Windows system. In other words, you can use it to make a USB flash drive, hard drive or IDE / SATA drive in an enclosure read only. However, I make no guarantees as to its forensic validity.
Still, if your poor and you want to play around with making forensic images of thumb drives and other USB mass storage devices it may come in handy. You will see one of two icons in your system tray to indicate whether or not USB mass storage devices are set to be read only:
Thumbscrew is my attempt at a poor man's USB write blocker. When used it allows you to quickly enable or disable writing to all USB mass storage devices on your Windows system. In other words, you can use it to make a USB flash drive, hard drive or IDE / SATA drive in an enclosure read only. However, I make no guarantees as to its forensic validity.
Still, if your poor and you want to play around with making forensic images of thumb drives and other USB mass storage devices it may come in handy. You will see one of two icons in your system tray to indicate whether or not USB mass storage devices are set to be read only:
USB Write Enabled
USB Write Disabled
Simply click on the icon and choose the menu item to toggle write access.
All Thumbscrew really does is flip a bit in the registry at:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StorageDevicePolicies\WriteProtect
Thumbscrew has a few limitations:
1. I can't guarantee it's 100% forensically sound. Buy a proven USB hardware write blocker if you want to be sure.
2. USB mass storage devices that are already mounted as writable will stay writable until they are removed and reinserted. The same applies if you turn off read only protection while a USB mass storage device is active, it will become writable and stay that way until removed and reinserted.
Hope you all find this program useful.
0 comments:
Post a Comment