Read only USB stick trick
The sad demise of readily available, cheap USB sticks with a switch to flip the device to be read only has caused some problems when dealing with suspicious machines, especial when I’m off duty and I hear the dreaded words “Oow, you’re in IT – could you have a look at my computer quickly?”
Back in the good old days, I could pick them up at nearly all my favourite shops and the vendors gave them away by the bucket load, but alas, they seem to have all but disappeared.
CD/DVD or Blu-ray disks are great, but lugging around a harden CD case really does clash with some of my outfits and doesn’t always send out the right message, particularly at: romantic diners, standing at a checkouts or trying to order drinks at a bar. This is where a small USB key, fitting neatly in to a pocket, helps me blend in with the rest of humanly almost seamlessly. Almost.
The standard read/write USB keys fall prey to being infected and compromised the very second they are insert in to a machine, which, as we know is a bad thing.
Stuck with this dilemma, I stumbled upon a neat solution – Secure Digital (SD) Memory Cards.
SD Memory cards have a small lock switch on them, making them read only; they can reach up to a whooping 32GB, are only slightly more expensive than similar size USB drives and are common place (I can find them in the petrol stations, corner stores and on aeroplanes). Now add in a small SD reader, around the size of a normal USB drive, and this is perfect for incident response on an untrusted system in a pinch or when a full response kit isn’t viable.
With the size of SD memory cards, it means I can have my favourite recovery [1], incident handling and fun at -someone else’s - party [2] boot images each on their own SD card, hidden in a wallet, jacket lapel or hat band for ease of use. Producing them, seeming out of thin air, to fix a broken or infected machine amazes and astounds plus get brownie points at unexpected moments in life.
Another option for the uncluttered, nattily dressed Incident-Handler-around-town’s toolkit.
As always, if you have any better suggestions, insights or tips please feel free to comment.
[1] BartPE - http://www.nu2.nu/pebuilder/
[2] Backtrack - http://www.backtrack-linux.org/downloads/
Chris Mohan --- Internet Storm Center Handler on Duty
Comments
SDHC support larger sizes, but aren't compatible with all but the latest readers. SD is much more common, and has been around for years and years.
A better fix may be a SD/SDHC card in an appropriate 'mini' card reader - as this gives you both compatibility and the read-only feature you're after.
Share and Enjoy,
Dom
Dom De Vitto
Mar 22nd 2011
1 decade ago
Raymond
Mar 22nd 2011
1 decade ago
RLG
Mar 22nd 2011
1 decade ago
BLAS
Mar 22nd 2011
1 decade ago
They are a little bit bulkier than most of your drives but I have never needed an extension to fit it to a USB slot. The rugged aluminum case and cap design do give me a little peace of mind as it rattles amongst my pocket change that it is not as likely to be damaged as previous drives have...
The IronKey drives do offer a great solution for protecting data on the drive from being destroyed but in this scenario do not offer the desired protection. When dealing with viruses, you need to be sure that the nasties can't be written to the drive and then on to the next computer...
John
Mar 22nd 2011
1 decade ago
With the varied range of host equipment I run into daily, that is too vague for me to feel comfortable with a storage device/medium I use often. I'm now using an 8gb Kangaru drive and it works as advertised.
Mike S
Mar 22nd 2011
1 decade ago
http://www.amazon.com/SanDisk-Ultra-Plus-2GB-Card/dp/B000EWI8IK
Joe G
Mar 22nd 2011
1 decade ago
@echo off
echo "Enter Size"
set /p len=
fsutil file createnew fillup %len%
PAUSE
Danny
Mar 22nd 2011
1 decade ago
jhstockman
Mar 22nd 2011
1 decade ago
Steven
Mar 22nd 2011
1 decade ago