USB image from live Windows PC

Is it possible to acquire a USB flash drive image from a live Windows PC without altering any data from the USB flash drive?

If the drive is already plugged into the computer and you ran FTK Imager, nothing on the USB would change. If the USB is not plugged in and you use a software or hardware write block nothing changes. If you just plug the USB drive into a Windows machine, typically auto-run will detect and run the drive possibly changing the contents or access times depending on the contents of the drive.

If you plug a USB drive into a Windows computer it installs drivers on the PC (not the USB drive). So in that case the PC not the USB drive changes because of the drivers required to access the USB drive.

If the USB is read only, the PC still changes, but the USB obviously remains untouched.

Hi,

Check out http//www.accessdata.com/media/en_US/print/papers/wp.USB_Write_Protect.en_us.pdf for instructions to write protect the USB drive

You can also write block usb drives by altering a registry key. I'm sure googling this can tell you where. Another alternative is a small program that does this registry edit for you. I use one occasionally called M2CFG USB Writeblock.

Personally, I wouldn't acquire any USB drive without at least attempting write blocking it first. A registry key edit is better than nothing!

"…since Windows tends to automatically install the drivers and scan for files…"

The drivers are installed on the Windows PC, not onto the USB thumb drive.

This page includes the Registry setting for the USB software write-block, plus others
http//www.microsoft.com/technet/security/guidance/serversecurity/tcg/tcgch10n.mspx

IronGeek's reference to USB software write-blocking (Thumb Screw - includes the necessary Registry key to edit)
http//irongeek.com/i.php?page=security/thumbscrew-software-usb-write-blocker

IronGeek's Thumb Suck
http//irongeek.com/i.php?page=security/thumb-sucking-udf-flash-drive

Some other interesting stuff…

Disable USB Storage Devices
http//support.microsoft.com/kb/823732

USB BIOS hacking via the Registry
http//support.microsoft.com/kb/841858