Please HELP!! How to make a USB drive appear not working ?

[Rod Speed]

(e-mail address removed) wrote

The fact is that I do have a drive which has this behaviour.

Sure, but you said you didnt want to modify the hardware.

So there is no doubt whether this is possible or not. The problem is that
I obtained it unwillingly: caused by some surge or power interruption.

Yes, its certainly possible to modify the hardware to get
that result, but you said that you didnt want to do that.

You cannot write to it and you cannot format it (unless of course
if you use a disk editor to fix the information which has been
altered to restore a good image). Would be nice to know
what is the kind of alteration which causes this behavior,

It shouldnt be that hard to work that out if you get an identical
one which hasnt been damaged by a power interruption etc.

so that one can use it to create a drive which appears to
be broken (but which, knowing the trick, one can restore) ...

Its unlikely that that can be done without modifying the
hardware and you clearly said that you dont want to do that.

[I also have, as said before, another drive that, when
inserted, Windows does not show any drive letter]

Sure, that bit isnt hard to achieve by software.

Its a lot harder to not allow a reformat, particularly if
the user is allowed to write zeros thru the drive first.

 

[Rod Speed]

Ok Arno about the *first* example you may be right, because I have not
actually verified whether the drive has some physical damage. So, as
you say, it could well be that its is not formattable because of real
damage. Let's forget abot this one then.

About the second example "DRIVE LETTER not shown by Windows" I am
absolutely sure the drive is perfect because I have restored and used
the image several times.

I have obtained this behavior by chance. I loaded * as image *
a NON image file (actually I loaded a Movie: .AVI)

Its never been clear exactly what you mean by that last sentence.

It would be nice to know the minimum amount
of changes which cause this behavior.

If the drive isnt damaged, it must be a
change to the contents of one of the sectors.

There's a vareity of ways of making the drive letter go away,
most obviously not having a viable partition on the drive.

But thats nothing like your requirement that it cant be reformatted.

 

[pamelafluente]

Kook ah! Never heard before. Nice to learn new word! Is it offensive?
Has it anything to do with "Qualcuno volo sul nido del cuculo" ("One
Flew Over the Cuckoo's Nest") with Jack Nicholson ?

Its never been clear exactly what you mean by that last sentence.

Sorry! what isn't clear? I want to say that each byte in the file has
been transferred to the disk from the very first address (cylinder 0,
head 0, sector 1) overwriting partition table and all the other
metadata with the movie...

But thats nothing like your requirement that it cant be reformatted.

Yes. But if I can easily make Windows not to show the drive letter, the
user will not be able to format it using Windows.

That should be enough to discourage most of the user to try find out
what the USB drive contains. Dont' you think so? Clearly I am not
saying that this would fool anybody, but probably 100% of what you call
the WinIdiots...

So I have the impression that you have some suggestion on the bytes we
need to change to make the drive letter disappear in Windows. Do you?

[I am anly considering changes done with software. Consider the drive
sealed]

-Pam

 

[Rod Speed]

(e-mail address removed) wrote

Kook ah! Never heard before. Nice to learn new word! Is it offensive?

Nope, just an insult.

Has it anything to do with "Qualcuno volo sul nido del cuculo"
("One Flew Over the Cuckoo's Nest") with Jack Nicholson ?
Nope.

Sorry! what isn't clear?

'I loaded * as image * a NON image file'

I want to say that each byte in the file has been transferred
to the disk from the very first address (cylinder 0, head 0,
sector 1) overwriting partition table and all the other
metadata with the movie...

OK, thats clear now.

Yes. But if I can easily make Windows not to show the drive
letter, the user will not be able to format it using Windows.

Thats not correct with the NT/2K/XP family,
you can still use Disk Management.

That should be enough to discourage most of the user to try
find out what the USB drive contains. Dont' you think so?

Sure, but it wouldnt stop many users from reformatting it.

Clearly I am not saying that this would fool anybody,
but probably 100% of what you call the WinIdiots...

I dont, I'm MUCH too polite for that |-)

So I have the impression that you have some suggestion on the bytes we
need to change to make the drive letter disappear in Windows. Do you?

Yes, just molesting the partition table and partition boot record should do that
fine.

But that wont stop it being reformatted in Disk Management.

[I am anly considering changes done with
software. Consider the drive sealed]

Sure, it was clear that that is what you wanted.

 

[pamelafluente]

Rod Speed ha scritto:

(e-mail address removed) wrote


Nope, just an insult. )



Thats not correct with the NT/2K/XP family,
you can still use Disk Management.

I see. But, anyway, I think this measure would be enough stop most of
the people I have around.

Yes, just molesting the partition table and partition boot record should do that
fine.

Yes. I was quite sure about that. I just wanted to see whether anyone,
who clearly knows well the structure of the first sectors of a disk
(ntfs), had some specific suggestion on which addresses to modify
(hopefully only a *few* bytes, so that I can restore them manually ) to
obtain this effect (I don't want to copy a piece of Jack Nickolson's
movie each time: it's hard get back !!). That's all.

But that wont stop it being reformatted in Disk Management.

Ok. But it will stop 99% of the idiots I know.

Thank you very much for you infinite patience!!

-Pam

 

[Rod Speed]

(e-mail address removed) wrote

Rod Speed wrote

I see. But, anyway, I think this measure would be
enough stop most of the people I have around.

OK, in that case it isnt that hard to do at all.

Yes. I was quite sure about that. I just wanted to see whether anyone,
who clearly knows well the structure of the first sectors of a disk
(ntfs), had some specific suggestion on which addresses to modify

Like I said, I'd just kill the partition table entry. DiskEdit will
show you the actual bytes that the entry parameters occupy.

(hopefully only a *few* bytes, so that I can
restore them manually ) to obtain this effect

I'd just save the entire sector, modify it using DiskEdit,
editing the partition table entry, save that sector too,
and then you just need to write that sector on the USB
key from whichever copy of the sector you want to use
for the result you want, drive letter or no drive letter.

(I don't want to copy a piece of Jack Nickolson's
movie each time: it's hard get back !!).

Just writing a sector full of zeros to that
first physical sector would be fine too.

That's all.

Ok. But it will stop 99% of the idiots I know.

Thank you very much for you infinite patience!!

No problem.

 

[pamelafluente]

Thank you Rod. I will try that!!

Happy cracking to all!

-Pam