Comments on: Quickpost: Read-Only USB Stick

By: Didier Stevens

Didier Stevens — Wed, 02 Nov 2011 17:01:49 +0000

No problem, no offense taken.

I think that on a Windows system, this write block is implemented in the device drivers for USB-to-SD-card adapters. I’ll make a note to research this.

It’s just that people sometimes ask me for a non-writable USB stick to install their anti-malware tools on an infected machine.
This solution is appropriate for that, because AFAIK there is no malware in the wild that changes the drivers to be able to write to an SD card with the write protect tab.

By: Anonymous

Anonymous — Wed, 02 Nov 2011 16:52:07 +0000

TY for the reply. I didn’t mean to correct you, or anything like that. Just seeking clarification.

I did try your tip, and at least Windows doesn’t write anything. I’ll keep an eye out for anyone trying to bypass it with software, or written why it can’t be.

By: Didier Stevens

Didier Stevens — Wed, 02 Nov 2011 13:35:47 +0000

No, I’m not sure, and if you read that in my post, it’s not the message that I wanted to pass along.

I wrote this blogpost because I found a USB SD-card reader that doesn’t detect the write tab, and wanted to inform my readers about this.

This is a Quickpost, wich means that I didn’t do extensive research for this post.

By: Anonymous

Anonymous — Wed, 02 Nov 2011 00:10:19 +0000

Sorry to return to an old post, but are you sure the reader doesn’t allow write operations, and not simply asking the OS ‘please don’t write’?
See here:
http://www.fencepost.net/2010/03/usb-flash-drives-with-hardware-write-protection/

BTW it’s sad such a useful and simple feature is so damn hard to find.

By: Iain

Iain — Tue, 22 Dec 2009 18:28:25 +0000

Purely by chance, I visited PC World today and saw the one that you photographed above. I’ll certainly visit again and get one after Christmas. It’ll be a useful addition to my IT “box of tricks”!

By: Cédric Pernet

Cédric Pernet — Tue, 22 Dec 2009 11:15:22 +0000

Thanks for this interesting post, Didier ! Once again it shows that we have to be careful and check material on some neutral stuff before going for real forensic investigation.

By: Didier Stevens

Didier Stevens — Mon, 21 Dec 2009 20:36:27 +0000

It works like floppies: the floppy-reader has a sensor for the write-protection notch. Although the SD-card is an electronic device, the write-protection tab is mechanical. It’s up to the reader to detect the position of the tab and act accordingly.

The reader in the picture is a SanDisk MicroMate and works fine.

The one that doesn’t support the write-protection tab is an EMTEC EKAK101

By: Iain

Iain — Mon, 21 Dec 2009 18:05:42 +0000

That’s a nice tip Didier.

I’m surprised that the hardware can bypass the write protect switch on the SD card. I’d be interested to know which makes/models of SD-USB adapters work as expected, along with the make/model of that which gave you a surprise!