Please HELP!! How to make a USB drive appear not working ?

[pamelafluente]

I had a drive pen that saw damaged (probably) by a sudden interruption
of power.
The damage is particular and has the following features:

- No file is listed
- If you try to copy a file or a folder, Windows issues an error
"cannot copy file or folder to the disk"
- If you try to format the pen. The formatting seems to work (quickly).
but when it ends, windows display a message like "Impossible to
complete the formatting"

I think that if I could reproduce this behaviour, most of the people
would be fooled...

--------------------------

Another example:

I have tried loading as a disk image an arbitrary file, for instance a
movie.
The result is that Windows see the USB drive but does not display any
letter (such as d:, e. So there is no way to use or format it.

This behaviour is even more difficult for an user to understand...

-Pam

 

[Arno Wagner]

That approach has a flaw: Let's assume that the partition is really a
VFAT partition (as is usually the case). The person who finds the
stick will probably try to create a VFAT partition in the same place,
and will then probably see that there is already a VFAT file system
and have access to the data (On a related note, I actually had a
prolonged fight with the debian installer on an Alpha where among
other things the installer ignored the partition type in the partition
table as soon as it saw something that it recognized as a file system
in the first block of the partition).

It requires a pretty incompetent (today: the standard) user to not see
through this. However the filesystem re-creation will not work, since
it writes an empty fat and root directory, i.e. while the data-secors
will be intact, the new filesystem will seem empty.

A slight variation of the approach is to let the actual partition
start at cylinder 2 (or something like this), and let the only
partition of the misleading partition table start at cylinder 1. Then
the scenario above is more unlikely to happen.

See above.

However, the best solution for this problem IMO is the use of an
encrypted partition on the stick.

If you use the right software and a
good passphrase, this should resist even expert attackers who only get
the stick, and it should be less cumbersome than the
partition-table-swizzling approach.

I completely agree. Might not be what the OP wants, since I
already suggested this.

Arno

 

[Arno Wagner]

I had a drive pen that saw damaged (probably) by a sudden interruption
of power.
The damage is particular and has the following features:

- No file is listed
- If you try to copy a file or a folder, Windows issues an error
"cannot copy file or folder to the disk"
- If you try to format the pen. The formatting seems to work (quickly).
but when it ends, windows display a message like "Impossible to
complete the formatting"

I think that if I could reproduce this behaviour, most of the people
would be fooled...

But can you still access the data on it?

--------------------------

Another example:

I have tried loading as a disk image an arbitrary file, for instance a
movie.
The result is that Windows see the USB drive but does not display any
letter (such as d:, e. So there is no way to use or format it.

Yes, but that will only fool a Windiot. Under Unix this is
pretty standard device usage. You can even play this movie
under Linux, e.g., directly by doing a

This behaviour is even more difficult for an user to understand...

Depends on the user. But if this is enough, then do this.

Arno

 

[John Turco]

But can you still access the data on it?




Yes, but that will only fool a Windiot. Under Unix this is
pretty standard device usage. You can even play this movie
under Linux, e.g., directly by doing a



Depends on the user. But if this is enough, then do this.

Arno

Hello, Arno:

"Windiot" ain't nice! :-J Perhaps, "Linux" should be mockingly referred
to as "Lordux," as its users seemingly tend to look down upon the
unwashed "Windoze" masses of the world.

Of course, you, yourself, would never display such snobbish behavior --
now, would you, Arno? <g>


Cordially,
John Turco <[email protected]>

 

[pamelafluente]

Arno Wagner ha scritto:

But can you still access the data on it?

Actually I wouldn't know how. I should probably study the question ( I
do not know the NTFS specs), but does not seem easy at all for me to do
it.

Yes, but that will only fool a Windiot. Under Unix this is
pretty standard device usage. You can even play this movie
under Linux, e.g., directly by doing a

cat /dev/<usb-devide> | mplayer -

Really? Well I dont' know anything about Linux. But please notice that
I did not copy the movie on the disk, but on 4GB disk I loaded a 1.5GB
wrong image (the movie, an AVI renamed so that WINIMAGE accepts it).
Are you sure Linux will play that, seems strange...

 

[pamelafluente]

John Turco ha scritto:

Hello, Arno:

"Windiot" ain't nice! :-J Perhaps, "Linux" should be mockingly referred
to as "Lordux," as its users seemingly tend to look down upon the
unwashed "Windoze" masses of the world.

Of course, you, yourself, would never display such snobbish behavior --
now, would you, Arno? <g>

I am just wondering... if we take all the Windiots of the word,
what the Linux users' share would be?

 

[Folkert Rienstra]

It requires a pretty incompetent (today: the standard) user to not see
through this.

Including the resident Linux zealot, apparently.

However the filesystem re-creation will not work, since
it writes an empty fat and root directory,

That's done by Format, not Fdisk and alike.

i.e. while the data-secors will be intact, the new filesystem will seem empty.

More like unformatted.
And Fdisk will scribble F6 data through lots of the data area too.

 

[Anton Ertl]

It requires a pretty incompetent (today: the standard) user to not see
through this. However the filesystem re-creation will not work, since
it writes an empty fat and root directory, i.e. while the data-secors
will be intact, the new filesystem will seem empty.

What writes an empty FAT and root directory? Setting the partition
type with fdisk and the like won't.

There is no file system recreation in that scenario, as the file
system never was formatted or any of the file system's blocks written.

So, after changing the partition type, the person who found the stick
might directly see the contents of the disk; he certainly will if he
unplugs and replugs the stick. Even if he tries to proceed directly
with formatting, my experience with Windows formatting software is
that it will warn the user that there is a file system on the stick;
and the person will likely become aware of the supposedly-hidden data
at that point.

See above.

With that variation, I consider it very unlikely that a user who
accicentially found the stick will find and access the data. Of
course, it is no help against a determined attacker who knows that
there is something on the stick that he is after, but I guess the OP
had some random person in mind who finds the stick after she loses it.

- anton

 

[Folkert Rienstra]

What writes an empty FAT and root directory?
Setting the partition type with fdisk and the like won't.

But it will destroy them.

There is no file system recreation in that scenario, as the file
system never was formatted
Huh?

or any of the file system's blocks written.

Think again.

So, after changing the partition type, the person who found the stick
might directly see the contents of the disk; he certainly will if he
unplugs and replugs the stick.

Uh, nope.

 

[Arno Wagner]

What writes an empty FAT and root directory? Setting the partition
type with fdisk and the like won't.

Setting the partition type will not. Creating a VFAT partition will
(partition type field != partition type). Seems to be a misunderstanding.
Of course just creating a partition and setting the type byte does keep
the old fileystem intact.

[...]

With that variation, I consider it very unlikely that a user who
accicentially found the stick will find and access the data.

After the misunderstanding above has been cleared up, I tend to agree.

Of
course, it is no help against a determined attacker who knows that
there is something on the stick that he is after, but I guess the OP
had some random person in mind who finds the stick after she loses it.

Well, for that encryption is both secure against professionals
and not too hard to use. Why all this obscure speculation?

Arno

 

[Oscar]

What writes an empty FAT and root directory? Setting the partition
type with fdisk and the like won't.

Setting the partition type will not. Creating a VFAT partition will
(partition type field != partition type). Seems to be a
misunderstanding. Of course just creating a partition and setting the
type byte does keep the old fileystem intact.

[...]

With that variation, I consider it very unlikely that a user who
accicentially found the stick will find and access the data.

After the misunderstanding above has been cleared up, I tend to agree.

Of
course, it is no help against a determined attacker who knows that
there is something on the stick that he is after, but I guess the OP
had some random person in mind who finds the stick after she loses
it.

Well, for that encryption is both secure against professionals
and not too hard to use. Why all this obscure speculation?

Looks like she wants to make it appear to be defective.

Guess that would reduce the chance of it being stolen.
Anything encryption wise that can see the USB key drive
used again with say a reformat would see it stolen.

 

[Arno Wagner]

Hello, Arno:

"Windiot" ain't nice! :-J

Well, I meant people prevented by Windows into not understanding
basic things, i.e. "Windows makes them incompetent" not "they
are idiots to use Windows". Still not nice, but often sadly
true.

Perhaps, "Linux" should be mockingly referred
to as "Lordux," as its users seemingly tend to look down upon the
unwashed "Windoze" masses of the world.

"Lordux". Sounds nice!

Of course, you, yourself, would never display such snobbish behavior --
now, would you, Arno? <g>

Others refer to me as "Guru" [1], or "Wizard" [2], but I would never
do so myself!

Arno

[1] http://www.catb.org/~esr/jargon/html/G/guru.html
[2] http://www.catb.org/~esr/jargon/html/W/wizard.html

 

[Folkert Rienstra]

Setting the partition type will not.

Creating a VFAT partition will (partition type field != partition type).

No it won't either. Formatting it will.

Seems to be a misunderstanding.

Yes, you obviously don't understand things Microsoft.

Of course just creating a partition and setting the type byte does keep
the old fileystem intact.

No it doesn't. Not with Fdisk.

[...]

With that variation, I consider it very unlikely that a user who
accicentially found the stick will find and access the data.

After the misunderstanding above has been cleared up, I tend to agree.

Of course, it is no help against a determined attacker who knows that
there is something on the stick that he is after, but I guess the OP
had some random person in mind who finds the stick after she loses it.

Well, for that encryption is both secure against professionals
and not too hard to use. Why all this obscure speculation?

Arno

 

[Eric Gisin]

Stop feeding the trolls, Turco!

Well, I meant people prevented by Windows into not understanding
basic things, i.e. "Windows makes them incompetent" not "they
are idiots to use Windows". Still not nice, but often sadly
true.

Arnie, you are a ****ing idiot.
I have never seen anyone give as much bad advice since Ronnie.

"Lordux". Sounds nice!

****up sounds better.

Of course, you, yourself, would never display such snobbish behavior --
now, would you, Arno? <g>

Others refer to me as "Guru" [1], or "Wizard" [2], but I would never
do so myself!

Most of us refer to you as the stupid Linux Troll.

 

[pamelafluente]

This place seems full of Wizards, Gurus and so on... but so far nobody
has answered the very simple question:

"what and where is (address) the minimum amount of data I need to
change to prevent anyone (not a technician) to be able to use or
reformat the USB drive"

....so let's see whether there is here, among many Windiots and
TrolLinuxes, at least 1 ordinary person who has this 2-byte of
information!

-Pam

 

[Arno Wagner]

This place seems full of Wizards, Gurus and so on... but so far nobody
has answered the very simple question:

"what and where is (address) the minimum amount of data I need to
change to prevent anyone (not a technician) to be able to use or
reformat the USB drive"

...so let's see whether there is here, among many Windiots and
TrolLinuxes, at least 1 ordinary person who has this 2-byte of
information!

Nobody has this information, since it does not exist. Everybody can
reformat any working USB key at every time. You cannot prevent
that. At least not without changing the USB key hardware.

As to use, you have not given exact enough definitions of "use" and
"anyone". This makes giving you the answer you want very hard. Much
of the discussion here was about what you might mean by these terms
and what level of competence is necessary for an user to see through
the different possibilities.

Maybe you believe technology can do everyting if you just know
enough. Please believe me that this is not the case.

Arno

 

[Rod Speed]

(e-mail address removed) wrote

This place seems full of Wizards, Gurus and so on...
but so far nobody has answered the very simple question:

Basically because it isnt something common enough that
anyone has bothered to workout all the detail and you
havent been very specific about exactly what you want to do.

"what and where is (address) the minimum amount
of data I need to change to prevent anyone (not a
technician) to be able to use or reformat the USB drive"

That last is new, the reformat. Thats much harder,
particularly if the user is allowed to write zeros
thru the drive and then just repartition and format.

You'd need a key drive with security for that.

...so let's see whether there is here, among many
Windiots and TrolLinuxes, at least 1 ordinary
person who has this 2-byte of information!

There's more than just 2 bytes involved
if you require that it cant be reformatted.

 

[pamelafluente]

The fact is that I do have a drive which has this behaviour. So there
is no doubt whether this is possible or not. The problem is that I
obtained it unwillingly: caused by some surge or power interruption.
You cannot write to it and you cannot format it (unless of course if
you use a disk editor to fix the information which has been altered o
to restore a good image). Would be nice to know what is the kind of
alteration which causes this behavior, so that one can use it to create
a drive which appears to be broken (but which, knowing the trick, one
can restore) ...

[I also have, as said before, another drive that, when inserted,
Windows does not show any drive letter]

 

[Arno Wagner]

The fact is that I do have a drive which has this behaviour. So there
is no doubt whether this is possible or not. The problem is that I
obtained it unwillingly: caused by some surge or power interruption.
You cannot write to it and you cannot format it (unless of course if
you use a disk editor to fix the information which has been altered o
to restore a good image). Would be nice to know what is the kind of
alteration which causes this behavior, so that one can use it to create
a drive which appears to be broken (but which, knowing the trick, one
can restore) ...

[I also have, as said before, another drive that, when inserted,
Windows does not show any drive letter]

O.k., you have a drive with this behaviour for the things you tried
to do to it. First question is: Are you sure it works correctly?
If you suspect a power-surge, it may well be damaged. The second,
more serious problem is that you have no idea what the limits
of this "protection" are. Maybe it is just your exact system
configuration. Maybe it is more universal. Maybe you installed drivers
that came with this specific drive that are flawed. It is extremely hard
to judge.

Also I am sure this drive can be formatted if it is cleared first. How
to do it is a frequently asked question here and it is really not an
expert-level operation.

Arno

 

[pamelafluente]

O.k., you have a drive with this behaviour for the things you tried
to do to it. First question is: Are you sure it works correctly?
If you suspect a power-surge, it may well be damaged. The second,
more serious problem is that you have no idea what the limits

Ok Arno about the *first* example you may be right, because I have not
actually verified whether the drive has some physical damage. So, as
you say, it could well be that its is not formattable because of real
damage. Let's forget abot this one then.

About the second example "DRIVE LETTER not shown by Windows" I am
absolutely sure the drive is perfect because I have restored and used
the image several times.
I have obtained this behavior by chance. I loaded * as image * a NON
image file (actually I loaded a Movie: .AVI)

It would be nice to know the minimum amount of changes which cause this
behavior.

-Pam