Re: Please HELP!! How to make a USB drive appear not working ?

Arno Wagner <me@xxxxxxxxxxx> writes:
>Previously Anton Ertl <anton@xxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>> Arno Wagner <me@xxxxxxxxxxx> writes:
>>>Or you could set a
>>>filesystem type that indicates a filesystem not in wide use,
>>>for example 0xeb for BeOS fs.
>
>> That approach has a flaw: Let's assume that the partition is really a
>> VFAT partition (as is usually the case). The person who finds the
>> stick will probably try to create a VFAT partition in the same place,
>> and will then probably see that there is already a VFAT file system
>> and have access to the data (On a related note, I actually had a
>> prolonged fight with the debian installer on an Alpha where among
>> other things the installer ignored the partition type in the partition
>> table as soon as it saw something that it recognized as a file system
>> in the first block of the partition).
>
>It requires a pretty incompetent (today: the standard) user to not see
>through this. However the filesystem re-creation will not work, since
>it writes an empty fat and root directory, i.e. while the data-secors
>will be intact, the new filesystem will seem empty.

What writes an empty FAT and root directory? Setting the partition
type with fdisk and the like won't.

There is no file system recreation in that scenario, as the file
system never was formatted or any of the file system's blocks written.

So, after changing the partition type, the person who found the stick
might directly see the contents of the disk; he certainly will if he
unplugs and replugs the stick. Even if he tries to proceed directly
with formatting, my experience with Windows formatting software is
that it will warn the user that there is a file system on the stick;
and the person will likely become aware of the supposedly-hidden data
at that point.

>> A slight variation of the approach is to let the actual partition
>> start at cylinder 2 (or something like this), and let the only
>> partition of the misleading partition table start at cylinder 1. Then
>> the scenario above is more unlikely to happen.
>
>See above.

With that variation, I consider it very unlikely that a user who
accicentially found the stick will find and access the data. Of
course, it is no help against a determined attacker who knows that
there is something on the stick that he is after, but I guess the OP
had some random person in mind who finds the stick after she loses it.

- anton
--
M. Anton Ertl Some things have to be seen to be believed
anton@xxxxxxxxxxxxxxxxxxxxxxxxxx Most things have to be believed to be seen
http://www.complang.tuwien.ac.at/anton/home.html
.

Relevant Pages

  • Re: Booting - Enterprise Volume Management System
    ... nothing to do with LVM and everything to do with file systems. ... bother with LVM on a single disk if you can just make one big partition? ... Runaway processes can't fill the filesystem, ... windows machine when exchange fills the file system. ...
    (Ubuntu)
  • Re: Live vv installed Linuxes?
    ... which partition is the root filesystem, ... filesystem for errors, this is then mounted. ... perhaps by changing partition sizes, but also how it might accomodate ... simply install its bootloader inside its own root partition and you're ...
    (comp.os.linux.misc)
  • Re: Dump/restore to clone disk
    ... the first file system on the hard drive slice. ... Swap isn't a filesystem. ... partition, ...
    (freebsd-questions)
  • RE: lvm on RH8 _ SOLVED_
    ... Apparently, the lvm module wasn't getting initialised at boot, so I ... Using fdisk, change the partition usage to 0x8e (free space, logical ... Next the filesystem needs to be created in the logical volumes. ...
    (RedHat)
  • Re: question about fstab in squeeze and uuid
    ... partition is assigned when the partition is formatted, ... at which time a new UUID is calculated. ... To provide redundancy and/or extra performance, or simply to be able to move the physical blocks from a location to another without affecting the logical volume as seen by the filesystem. ... Filesystems can be identified by their location, UUID, label or contents. ...
    (Debian-User)