kanguru

This forum is intended for computer technicians only. Post IT related topics here.
Forum rules
We have no special rules for UVK forums. Just try to be polite and clear in your posts.
Please don't post spam in this forum. Spammers will be banned by IP, e-mail and username.
We reserve the right to delete all posts and ban all users we consider not having respected these rules without warning.
Post Reply
Charger440
Posts: 1529
Joined: Sun May 25, 2014 7:44 am
Location: Missouri

kanguru

Post by Charger440 »

If you are not aware. These drives have a physical switch that prevents writing to them. I use them every time I suspect a computer is infected which is pretty much every time. They are reasonably priced and have metal bodies for better durability.


https://www.kanguru.com/storage-accesso ... ives.shtml
Jim

It is not "Can it be done?" but rather, "How can we do it?"
Xander
Posts: 438
Joined: Sun May 24, 2015 11:55 pm
Contact:

Re: kanguru

Post by Xander »

Most SD cards seem to have the same switch as well (and can be found just about everywhere). I keep one with me (and a cheap adapter) for when I'm dealing with a highly-infected system.
Brink
Posts: 283
Joined: Thu Jun 12, 2014 3:36 pm

Re: kanguru

Post by Brink »

And if you cant afford the Kanguru drive you can do a software write protect on the file system too. You can put your tools into an ISO. Then put the ISO along with Virtual Clone Drive (http://www.slysoft.com/en/virtual-clonedrive.html)on a thumbdrive that is formatted NTFS. Then .....
Taken from:https://www.reddit.com/r/techsupport/co ... e_when_it/

You could use diskpart to set the drive as readonly
You would have to Create an NTFS partition, write the content you want to the USB drive and then use diskpart utility in command line and use the command "attributes volume set readonly" once you've selected the volume
Here are the detailed steps:
(all of the commands are listed in quotes DO NOT type the quotes)
1) open command prompt and type "diskpart" and hit enter.
2) type "list disk" (this will list all of the volumes currently connected to your computer, you should see one that is the size of your USB stick, be it 8GB, 16GB, 32GB and so on)
3) located associated number next to the disk you wanted (e.g Volume 2 = 32GB Sandisk Cruzer)
4) type "select Disk 2"
5) type "detail disk" to see each volume on the disk (there should only be one NTFS for more USB sticks)
6) type "select volume 0" (if 0 is the number for the volume you want)
7) type "attributes volume set readonly" (the command may need a hyphen (-) in the word readonly [e.g. read-only] depending on your version of diskpart)
8) type "exit"
Then your done. The volume should now be readonly. Again this is a workaround as many of the other suggestions and won't deny someone from formatting the USB stick.
http://community.spiceworks.com/topic/3 ... ng-deleted
After that, to use your tools on a target system, simply install the Virtual Clone Drive and mount your ISO as a virtual CD.

Although it's not as secure as the switch, it will protect against all but the most robust of viruses that can circumvent the read only attribute that you set on the file system of the usb drive. And even if it can do that, only the first level of the thumbdrive is at risk. Your tools are safe from infection. The virus would have to be able to circumvent the NTFS read only attribute and then also be able to extract and infect the ISO then repack it back into an ISO image and put it back on the drive.

None of that is very likely. Turn off auto execute for usb devices on your own machine by getting and running Microsoft Fix it 50471 thats about 1/3 the way down on this page https://support.microsoft.com/en-us/kb/967715 . After that you can pretty much be sure that you can plug the thumb back into your machine and scan it for bugs very quickly as it only has two files on it - the virtual clone drive installer and the iso.

Thats a lot of trouble to keep from dropping $40 for a Kangaru, but it's what I do. LOL :lol: I always do things the hard way it seems.
Fred
Site Admin
Posts: 2357
Joined: Sat Jul 30, 2011 12:05 pm
Location: Red coast, France
Contact:

Re: kanguru

Post by Fred »

Because Windows 10 natively supports ISO files, you don't need to install Virtual Clone Drive, making the process faster.
One thing we humans have in common is that we are all different. So, if you think you're weird because you're different from everyone else, then we are all weird.

Fred
Brink
Posts: 283
Joined: Thu Jun 12, 2014 3:36 pm

Re: kanguru

Post by Brink »

Thanks Fred. Good to know. But put the Virtual Clone drive there anyway so that your stick works with 7, 8, vista, and xp.
Charger440
Posts: 1529
Joined: Sun May 25, 2014 7:44 am
Location: Missouri

Re: kanguru

Post by Charger440 »

Kanguru drives have a physical switch which prevents anything from writing to the drive unlike the software based Sandisk protection. To change my Kaguru I just flip the switch and write and delete all I want. No need to rebuild ISO files and worry whether it compiled right.

I'm pretty sure Windows 8 supports ISO as well.
Jim

It is not "Can it be done?" but rather, "How can we do it?"
Xander
Posts: 438
Joined: Sun May 24, 2015 11:55 pm
Contact:

Re: kanguru

Post by Xander »

Image
Just sayin'
Brink
Posts: 283
Joined: Thu Jun 12, 2014 3:36 pm

Re: kanguru

Post by Brink »

Trouble is I don't have a 256gig usb 3.0 sandisk card. I do have a thumb drive that big and fast though. Sadly it's not a Kanguru drive with the switch. I think most of us are aware of the switch on the side of the card because the crap is always catching on the side of the slot when we plug it in. Then when you are ready to take a picture you miss your shot because the card is locked. I have been known to hot glue that junk to writable. hehe
Post Reply