Why Would I want to Write Protect USB Devices?
A private computer that is shared by others or a company computer can contain personal, confidential or commercially sensitive information.
Such information can easily be copied from the computer if the user connects a USB data stick or hard drive to it.
To prevent this, a normally hidden feature within Windows can be enabled to prevent any data being transferred to external storage through the USB ports.
How to Enable USB Write Protection in Windows using the Registry Editor
Launch the Registry Editor by either pressing the ‘Windows’ and ‘R’ keys, this will produce a window containing a field box where you need to type ‘regedit’ and then press ‘Ok’, or by typing ‘Regedit’ into the start menu search bar and select the application within the window to launch it.
Once ‘Regedit’ is open, navigate to the path \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control and then within that path use the mouse right click and select New and then Key.
Name the new key ‘Storage Device Policies’ and then within that key create a new 32-bit DWORD named ‘writeprotect’. See below for an example.
Open the DWORD you have just created and alter the value within it from 0 to 1. This will write protect any USB devices that are connected to the computer, preventing any user from transferring any data to it.
It will also allow any such devices to be examined or acquired without any data present on them from being altered.
In order to allow for the transfer of data to USB devices after this, the value within DWORD named writeprotect will need to be altered from ‘1’ to ‘0’ again.
How to Enable USB Write Protection in Windows using the Group Policy Editor
Group Policy Editor is only available in the Windows Professional, Education and Enterprise editions.
In the start menu search bar type gpedit.msc and select the file of the same name to run the Group Policy Editor.
Within the Group Policy Editor browse to the path User Configuration\Administrative\Templates\System\Removable Storage Access.
Identify the keys Removable Disks: Deny read access and Removable Disks: Deny write access.
Alter the bullet options within these keys from ‘Not Configured’ to ‘Enabled’ and then select ‘Apply’ in the bottom right side of the window and then ‘Ok’.
Any USB devices connected to the computer will now be write protected preventing any data from being transferred to them or any information contained on them from being altered.
To disable the write protection, the option ‘Not Configured’ needs to be selected within the keys named Removable Disks: Deny read access and Removable Disks: Deny write access.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any computer forensic investigation.
Our digital forensics experts are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 10 years.
Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
https://athenaforensics.co.uk/service/mobile-phone-forensic-experts/
https://athenaforensics.co.uk/service/computer-forensic-experts/
