Please HELP!! How to make a USB drive appear not working ?

[pamelafluente]

I need help with an uncommon matter.

I have a USB drive (it's a 4Gb pen drive). What I need is a trick so
that if one tries the drive on any PC it will appear to be not working
(even to an experienced user).

On the other hand the trick must be safe and reversible, that is,
whenever I want the drive must work again perfectly.

Data can be lost, but the drive must NOT suffer any damage.

Would you kindly suggest some possible ways to do this trick?

Thank you very much!!

-Pam

PS
what about if I start formatting it and interrupt the formatting? Would
I damage it?

 

[Arno Wagner]

I need help with an uncommon matter.

I have a USB drive (it's a 4Gb pen drive). What I need is a trick so
that if one tries the drive on any PC it will appear to be not working
(even to an experienced user).

On the other hand the trick must be safe and reversible, that is,
whenever I want the drive must work again perfectly.

Data can be lost, but the drive must NOT suffer any damage.

Would you kindly suggest some possible ways to do this trick?

Thank you very much!!

-Pam

The only thing you can do is install a hidden switch, e.g. in
one of the data lines. Software cannot do this. The hidden switch
will not fool any determined attacker wit basic electronics
knowledge and installation may be arbitrary difficult, depending
on the drive.

Maybe talk a bit about your objective. If you want to make the data
on it inaccessible, encryption usually is the way to go.

PS
what about if I start formatting it and interrupt the formatting? Would
I damage it?

Usually not. But why do you want to do that?

Arno

 

[pamelafluente]

Hi would like something that can be done with software. Tempering with
hardware is out of the question.

I just want the drive to appear malfunctioning like. For instance:

- Impossible to copy file in it
- Total Capacity = 1Kb
- Drive letter not appearing when connected

- or any other critical malfunction ...

The loss of data is not aproblem and is acceptable.

Any idea? Is there an utility easy to use to mess with sectors and so
on
and which can be easily undone ?

 

[Rod Speed]

I need help with an uncommon matter.

I have a USB drive (it's a 4Gb pen drive). What I need
is a trick so that if one tries the drive on any PC it will
appear to be not working (even to an experienced user).

Thats a bit harder, just what level of experienced user ?

On the other hand the trick must be safe and reversible,
that is, whenever I want the drive must work again perfectly.

Data can be lost, but the drive must NOT suffer any damage.

Would you kindly suggest some possible ways to do this trick?

what about if I start formatting it and interrupt the formatting?
Would I damage it?

You can do.

would like something that can be done with software.
Tempering with hardware is out of the question.

I just want the drive to appear malfunctioning like. For instance:

- Impossible to copy file in it
- Total Capacity = 1Kb
- Drive letter not appearing when connected

- or any other critical malfunction ...

The loss of data is not aproblem and is acceptable.

Any idea?

It shouldnt be too hard to replace the contents of one sector to
get that effect. That wont necessarily work if the experienced user
uses one of the pen drive recovery apps to get the data back tho.

Just replacing the MBR with data that produces that
result when trying to read the drive should work fine.

Is there an utility easy to use to mess with sectors and so on

Yes, any decent disk sector editor should be able to do that.

and which can be easily undone ?

Yes, just replace the data in the molested sector with the correct data.

Makes more sense to encrypt the data rigorously tho.

 

[pamelafluente]

Rod Speed ha scritto:

(e-mail address removed) wrote:

Thats a bit harder, just what level of experienced user ?

For now it is sufficient that the drive appears malfunctioning
at a superficial exam. No use if recovery tool.

You can do.

Ok. Let's forget about it

Yes, any decent disk sector editor should be able to do that.

Given that I am not a technician, but an average user. Would you please
tell me with some degree of accuracy the precise steps I have to do?
Consider that the drive was lastly formatted NTFS. Do I have to revert
to FAT?

Ok. Then I get a disk editor. Could you suggest which is advisable to
use, so I can get from the web.

And once I have it. Could you suggest which address is best to
manipulate and which values should I write? I would like to change as
little as possible (possibly just 1 byte or so).

Once I have done this change. Will I be able to access the disk with
the disk editor and restore the values which have been changed?

Thank you VERY much !

-Pam

 

[Rod Speed]

(e-mail address removed) wrote

Rod Speed wrote

Given that I am not a technician, but an average
user. Would you please tell me with some degree
of accuracy the precise steps I have to do?

Thats a bit harder. I cant be bothered doing the research on the
changes you need to make to the MBR to get the effect you want.

Consider that the drive was lastly formatted
NTFS. Do I have to revert to FAT?
Nope.

Ok. Then I get a disk editor. Could
you suggest which is advisable to use,

I prefer Norton's DiskEdit myself. Dont have a USB
pen drive handy currently to check if it will edit the
sectors on one of those, its getting a little old now.

so I can get from the web.

Since I only used DiskEdit, I cant be bothered checking which
of the free ones can edit a sector on a USB pen drive.

And once I have it. Could you suggest
which address is best to manipulate

I'd try it with the MBR myself, thats the first physical sector,
and the partition BR as well. That varys a bit LBA wise.

and which values should I write?

That would take a bit of trial and error to get that result you want.
Not hard to get the size you want, thats the partition start and stop
logical block numbers, but it would require a bit more research to
work out what you need to molest to have the OS decide that its
too corrupted to be useful. That doesnt take much with NTFS tho.

I would like to change as little as possible (possibly just 1 byte or so).

The best approach would be to work out what changes need to be
made to those two sectors to get the result you want, then just
save those to files so you can write them to the USB pen drive
whenever you want. Any decent disk sector editor can do that.

Once I have done this change. Will I be able to access the disk with
the disk editor and restore the values which have been changed?

Yes, just save the original of both those sectors to a disk file
and restore them to the original when you want to use it again.

 

[pamelafluente]

Now that you make me think of that I remember that about 10 years ago I
wrote 2 utilities which allowed to save the MBR to a file and restore
it from a file.

But, if I remember well, it used the int13. Don't know if USB support
is at BIOS level through appropriate extensions or it is provided at an
higher level ( maybe from theOS ? )

Perhaps someone has similar utilities working also for USB drives...

 

[Rod Speed]

Now that you make me think of that I remember that
about 10 years ago I wrote 2 utilities which allowed
to save the MBR to a file and restore it from a file.

Yeah, its very easy to do.

But, if I remember well, it used the int13. Don't know if USB
support is at BIOS level through appropriate extensions or
it is provided at an higher level ( maybe from theOS ? )

Its certainly possible to do it, but since you need
to edit the value in the sectors too, you might as
well just use a sector editor that works with USB drives.

Perhaps someone has similar utilities working also for USB drives...

Yes, sector editors that work with USB
drives certainly exist, I just cant name them.

 

[pamelafluente]

Hi Rod. Thank you for your support.

I have just done an image of the whole drive using WINIMAGE (very nice
software).

Now, I am ready to proceed with a disk editor and edit some byte on the
first sector of the disk.

At this point, it would be crucial to get the information on which
address I should modify
in order to make the drive unreadable by Windows (xp, ...) so that
either it would not see it
or would not be able to access even for simple formatting.

** Let's see if there is some reader here who has this information...
**

Thank you very much in advance.

-Pam

 

[pamelafluente]

Yes, sector editors that work with USB
drives certainly exist, I just cant name them.

Ah forget to mention that a disk editor usable for this purpose is:
Acronis Disk Director Suite 10.0
http://www.acronis.com/enterprise/products/diskdirectorsuite/disk-editing.html

 

[Rod Speed]

(e-mail address removed) wrote

Hi Rod. Thank you for your support.

I have just done an image of the whole drive
using WINIMAGE (very nice software).

Now, I am ready to proceed with a disk editor
and edit some byte on the first sector of the disk.

It isnt JUST that sector, you need to modify the partition boot sector too.

At this point, it would be crucial to get the information on which
address I should modify in order to make the drive unreadable
by Windows (xp, ...) so that either it would not see it
or would not be able to access even for simple formatting.

I'd just try modifying the partition boot sector to see what you
need to bugger up to get XP to claim that it isnt formatted.
Just writing zeros thru that sector might well be all you need to do.

** Let's see if there is some reader here who has this information... **

Easiest to just try it, zeros should be all it needs.

Thank you very much in advance.

No problem.

 

[pamelafluente]

I'd just try modifying the partition boot sector to see what you
need to bugger up to get XP to claim that it isnt formatted.
Just writing zeros thru that sector might well be all you need to do.

Problem is... I know nothing about NTFS, I don't even know at what
physical address the partition table starts ...

 

[Rod Speed]

Ah forget to mention that a disk editor usable for this purpose is:
Acronis Disk Director Suite 10.0
http://www.acronis.com/enterprise/products/diskdirectorsuite/disk-editing.html

Yeah, forgot about that one, it will certainly do the job fine.

 

[Rod Speed]

Problem is... I know nothing about NTFS, I don't even
know at what physical address the partition table starts ...

Thats the reason I like Norton's DiskEdit, it does all that stuff
for you auto, you can see the MBR in various formats, with
the partition table format one of those formats, and the same
with the partition boot sector too.

 

[pamelafluente]

Ah ok. I will give it a try then....

-Pam

 

[Arno Wagner]

Hi would like something that can be done with software. Tempering with
hardware is out of the question.

I just want the drive to appear malfunctioning like. For instance:

- Impossible to copy file in it
- Total Capacity = 1Kb
- Drive letter not appearing when connected

- or any other critical malfunction ...

The loss of data is not aproblem and is acceptable.

Any idea? Is there an utility easy to use to mess with sectors and so
on
and which can be easily undone ?

There is no malfunction you can simulate using software that will fool
an expert. Yes, you can scramble/encrypt and the like, but it will
still be obvious that the drive is working fine and that the
data-layout is messed up instead.

Arno

 

[pamelafluente]

Hi Arno. I am aware of that. I just wanted keep off most of the
people(users, not technician ). Clearly a technician with the right
tool could restore the drive (altought quite possibly he would destroy
(some of ) the data)...

-Pam

 

[Arno Wagner]

Hi Arno. I am aware of that. I just wanted keep off most of the
people(users, not technician ). Clearly a technician with the right
tool could restore the drive (altought quite possibly he would destroy
(some of ) the data)...

Unlikely. Any professional would make an image first.

To keep off users, it may be enough to remove the partition
table, which makes the drive look empty. Or you could set a
filesystem type that indicates a filesystem not in wide use,
for example 0xeb for BeOS fs. It all depends on what level
of knowledge you assume and what you want to prevent.

Clearly every user can reformat the drive, since you cannot
simulate a physical error just using software.

So what exactly do you want, given this constraint?

Arno

 

[Folkert Rienstra]

Unlikely. Any professional would make an image first.

To keep off users, it may be enough to remove the partition
table, which makes the drive look empty. Or you could set a
filesystem type that indicates a filesystem not in wide use,
for example 0xeb for BeOS fs. It all depends on what level
of knowledge you assume and what you want to prevent.

Clearly every user can reformat the drive, since you cannot
simulate a physical error just using software.

That depends on whether a 'Write Long' is supported.

 

[Anton Ertl]

Or you could set a
filesystem type that indicates a filesystem not in wide use,
for example 0xeb for BeOS fs.

That approach has a flaw: Let's assume that the partition is really a
VFAT partition (as is usually the case). The person who finds the
stick will probably try to create a VFAT partition in the same place,
and will then probably see that there is already a VFAT file system
and have access to the data (On a related note, I actually had a
prolonged fight with the debian installer on an Alpha where among
other things the installer ignored the partition type in the partition
table as soon as it saw something that it recognized as a file system
in the first block of the partition).

A slight variation of the approach is to let the actual partition
start at cylinder 2 (or something like this), and let the only
partition of the misleading partition table start at cylinder 1. Then
the scenario above is more unlikely to happen.

However, the best solution for this problem IMO is the use of an
encrypted partition on the stick. If you use the right software and a
good passphrase, this should resist even expert attackers who only get
the stick, and it should be less cumbersome than the
partition-table-swizzling approach.

- anton