I have just found this on the microsoft site. I haven't had time to test it
yet though.
Registry hack for write protect usb
Controlling block storage devices on USB buses
What does controlling block storage devices on USB buses do?
This feature provides the ability to set a registry key that will prevent
write operations to USB block storage devices, such as memory sticks. When
this registry key is enabled, the devices function only as read-only
devices. You can implement this setting as part of a security strategy to
prevent users from transporting data using these devices.
Who does this feature apply to?
•
Users who do not want data to be written from their computer to a USB
storage device.
•
IT professionals who want to implement organization controls over the
use of USB block storage devices
What settings are added or changed in Windows XP Service Pack 2
Setting name
Location
Default value
Possible values
WriteProtect
HKEY_LOCAL_MACHINE\System\
CurrentControlSet\Control \StorageDevicePolicies
DWORD=0
0 - Disabled
1 - Enabled
Jon Webster
UK MoD
----- Original Message -----
From: "Joel A. Folkerts" <jfolkert@hiwaay.net>
To: "'Robert Goto'" <rgoto@seanet.com>; <forensics@securityfocus.com>
Sent: Monday, November 08, 2004 5:07 PM
Subject: RE: USB Write Blocker but going the other way?!
I've never heard of a hardware USB write blocker but I have used Linux many
times to mount the device as a read-only device. You can also use dd or
dcfldd to create images for analysis.
-----Original Message-----
From: Robert Goto [mailto:rgoto@seanet.com]
Sent: Saturday, November 06, 2004 6:00 AM
To: forensics@securityfocus.com
Subject: USB Write Blocker but going the other way?!
Does anyone out there know of hardware usb write blocker? I am looking for
something that blocks usb drives not ide drives. There are plenty of write
blockers out there which you can attach an ide drive to a computer via tne
usb port which write blocks the ide hard drive. What I'm looking for is
something that blocks writes to the usb side. I have opened up lots of usb
cases and gotten at them that way but I have a situation where this isn't
feasible. Suggestions would be much appreciated.
Robert Goto
Director of Forensic Services
True Data Partners
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service. For more
information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.788 / Virus Database: 533 - Release Date: 11/1/2004
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.788 / Virus Database: 533 - Release Date: 11/1/2004
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
