Hard Disk Protection Issue

You are probably referring to DISKPART's SAN policy
(https://technet.microsoft.com/en-us/library/gg252636(v=ws.11).aspx)

eg
san [policy={OnlineAll | OfflineAll | OfflineShared}

No, I am SURELY NOT referring to the DISKPART's SANPOLICY.

I am referring to a third-party freeware tool as stated.

That program installed *something* that remained "sticky" (cannot really remember if it was a service or a filter driver) even when the tool was uninstalled, that happened on XP.

jaclaz

.. there was one free tool (software write blocker) around ..

There are two ways I know to block usb devices and one is san policy or attributes/read-only.
The only software write blocker I've seen used the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies\WriteProtect 'registry hack'.

The only other way I can think of to block/write protect would be with a proxy driver or by replacing MS's USB storage device driver. That, I haven't seen yet. Do you mean that this tool you refer to, did that?

.. there was one free tool (software write blocker) around ..

There are two ways I know to block usb devices and one is san policy or attributes/read-only.
The only software write blocker I've seen used the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies\WriteProtect 'registry hack'.

The only other way I can think of to block/write protect would be with a proxy driver or by replacing MS's USB storage device driver. That, I haven't seen yet. Do you mean that this tool you refer to, did that?

I mean EXACTLY (as I have written BTW) that that particular tool (of which I don't remember the name oops ) EITHER used a Filter Driver OR an Auto-start service (again I don't remember which of the two, BUT NOT *anything else*).
In a list form

1. NOT San policy
2. NOT the WriteProtect 1 in the Registry
3. EITHER a Filter driver
4. OR a service
5. NOT *anything else*
6. NO, it did NOT replace the USB Storage Device driver
7. Please see again points #3,#4 and #5 above

[/listo]

jaclaz

Have you been safely ejecting the drives prior to physically removing of the device?

@Kacos
Maybe it was this one (but I am not at all sure about it ? )
http//kashu-sd.co.jp/en/wpservice.html#content2

This one seems "properly written".

jaclaz

The original question to this thread was posed in 2015. I'm sure he either found the solution or gave up ages ago. I'm not sure why it's suddenly resurfaced in this forum the last few days

This one seems "properly written".

I see what you mean. But this is probably not the one that caused the problems you mentioned

"You can uninstall USB Flash Security Write-Protect Service from Add or Remove Programs of Control Panel. Restart will display, after restart USB Flash Security Write-Protect Service will stop automatically and file will be deleted, registry will be cleared."

But this is probably not the one that caused the problems you mentioned

"You can uninstall USB Flash Security Write-Protect Service from Add or Remove Programs of Control Panel. Restart will display, after restart USB Flash Security Write-Protect Service will stop automatically and file will be deleted, registry will be cleared."

Look, it is getting really tiring, I ALREADY stated that most probably it wasn't this one.

Originally I reported my experience and you decided to know better than myself what I was referring to.

AFTER I explicitly said that the tool involved used either a filter driver or an auto-start service, you came out with the "There are two ways I know …" and "The only other way I can think of to block/write protect would be with a proxy driver or by replacing MS's USB storage device driver. "

I showed you an EXAMPLE of a tool that INSTEAD uses an auto-start service, specifying TWICE (using "maybe" and "I am not at all sure") how very likely it wasn't the one I remember badly behaving AND stating how it was seemingly "well written", UNLIKE the one I was reporting my experience with.

Is it really needed to post that "But this is probably not the one that caused the problems you mentioned"?

I KNOW that, and actually I had just finished writing a statement to THAT effect.

WHAT is the sense to re-state the obvious? ?

Surely that tool (like every tool) works just fine in theory, but it is not the first time (nor it will be the last) that something may go wrong in practice.

I guess it never happened in your experience that for *whatever reasons* a program or filter driver or upper/lower filter or service failed to uninstall properly.

@Amnesia
Satyendra /the OP) actually replied on this thread twice a few days ago
https://www.forensicfocus.com/Forums/viewtopic/p=6589154/#6589154
https://www.forensicfocus.com/Forums/viewtopic/p=6589158/#6589158
just after athena (for whatever reasons) resuscitated the thread after one and a half year
https://www.forensicfocus.com/Forums/viewtopic/p=6588278/#6588278

It seems strange that someone has a PC without USB write access for over one year and hasn't find a way to solve the problem, still this seems the situation.

jaclaz

I ALREADY stated that most probably it wasn't this one.

I agreed - My apologies if I expressed it wrong (posted in a hurry).
Peace )

I guess it never happened in your experience that for *whatever reasons* a program or filter driver or upper/lower filter or service failed to uninstall properly.

Actually in my 20+ year experience, NO I haven't had such a problem that I wouldn't eventually solve after some digging. And definitely never had anything that would disable my USB drives (or write protect them) for over a year.

Actually in my 20+ year experience, NO I haven't had such a problem that I wouldn't eventually solve after some digging. And definitely never had anything that would disable my USB drives (or write protect them) for over a year.

Which is good ) , as also in my 30+ wink experience that didn't happen, but maybe the OP has *somewhat* less experience or has not (yet) grasped fully some concepts/theories of operation and cannot alone solve the issue.

jaclaz