RE: How to create a WINDOWS bootable disk with all the disk write-protected?

You can't use a regular bootable disk without modifying the MSDOS.sys and
IO.SYS files.

Make a bootable disk, then open up a hex editor (like winhex).
Search the bootable disk for C:\
Change every occurrence from C:\ to A:\ (there are something like 19 of
them)
Search for DRVSPACE.BIN and rename the calls from .BIN to .XXX
Delete DRVSPACE.BIN from the bootable disk.

NOW you are ready to build your scripts, you can used HDL or PDBLOCK or
similar as part of the script.  They both lock out write calls to INT13, but
you would be safer going with a physical blocking device.

In forensics, there are no do-overs.

Good luck!

Tobin

-----Original Message-----
From: Giamdo Kou [mailto:cybercrime@21cn.com] 
Sent: Tuesday, August 31, 2004 9:54 PM
To: forensics
Subject: How to create a WINDOWS bootable disk with all the disk
write-protected?

Hello:
I want to create a bootable disk with Bart PE builder. I want to boot it
with all the disk write-protected at the same time.
How can I do that? I think it may be a good idea to block all the write
operation to the disk by hook INT 13. Is there any software available to
provide write protection to all the disk in Windows? (A PDBLOCK on Windows
or something like that?) 
Thanks a lot!                           

　　　　　　　　Giamdo Kou
　　　　　　　　cybercrime@21cn.com
　　　　　　　　　　2004-09-01



-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com