It has occurred to me that one could build a completely malware-proof
PC by installed special disk drives that do not actually accept write
operations, but instead write them aside into a temporary area that is
deallocated each time the drive is reset. Has anyone ever built such
a drive?
The idea is this: The drive has a complete OS and applications
installed. After the machine is booted, all physical writes directed
to the drive are in fact written into a cache memory (potentially a
reserved part of the disk). Whenever the disk drive is reset, the
cache is erased (all updated data is discarded), and the drive is back
where it began. Thus, no matter what happens while the PC is running,
the next time it is reset or booted, it comes up squeaky clean again.
The problem is, part of what gives modern OS their
desirability is that they allow customization (even in minor
ways) that will need be remembered, not discarded, unless
the box is nothing more than a public kiosk where the
priority is a static interface for many different users.
The only way to disabled the write-aside would be through a hardware
switch that would be physically on the drive
Why?
It's not as though you'd deploy a HDD image like this and
not have a backup of it, and since there are no user changes
possible,it's not even a big deal to restore such backup,
there is nothing that would've been lost- so the need to
make it 100% secure may be gone.
--one that could only be
flipped by hand, by a human being. This feature would be used to
initially install stuff on the disk and to make any subsequent
modifications.
Quite a few things write to disk. I think more than you
realize.
So, has anyone done it? It would be great for Internet cafes in
particular.
The real question is what your exact goals are, not whether
a specific thing with a HDD is possible.
BIOS or a drive might be set for read-only, but what is a
reasonable prevention and what is foolproof, are different
things. Nothing is really foolproof, in the end some joker
will come along and take a sledgehammer or a box or just
kick it hard.
If all you want to do is redirect writes to cache memory,
take a look at EWF,
http://msdn.microsoft.com/library/d...ry/en-us/xpehelp/html/xerefewfdefinitions.asp
it is meant for XPe, Embedded, and suggested for removable
drive/device such as CDROM or flash memory based drive, but
that doesn't preclude use w/HDD, and a few have hacked it
into a regular XP too (middle of page),
http://www.windowsdevcenter.com/pub/a/windows/excerpt/CarPCHacks_Chap1/index.html?page=2
Then again, for those internet cafes it might be as well to
use XPe.