Thumbscrew: Software USB Write Blocker
Thumbscrew is an attempt at a poor man's USB write blocker. When used it allows you to quickly enable or disable writing to all USB mass storage devices on your Windows system. In other words, you can use it to make a USB flash drive, hard drive or IDE / SATA drive in an enclosure read only. However, there is no guarantees as to its forensic validity. Still, if you want to play around with making forensic images of thumb drives and other USB mass storage devices it may come in handy. You will see one of two icons in your system tray to indicate whether or not USB mass storage devices are set to be read only:
USB Write Enabled
USB Write Disabled
Simply click on the icon and choose the menu item to toggle write access. All Thumbscrew really does is flip a bit in the registry at:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StorageDevicePolicies\WriteProtect
Thumbscrew has a few limitations:
1. No guarantee it's 100% forensically sound. Buy a proven USB hardware write blocker if you want to be sure.
2. USB mass storage devices that are already mounted as writeable will stay writeable until they are removed and reinserted. The same applies if you turn off read only protection while a USB mass storage device is active, it will become writable and stay that way until removed and reinserted.
Hope someone finds this program useful.
No comments:
Post a Comment