Hard disk write-protection lock based on USB equipment under Windows environment

Abstract

The invention relates to the field of computer forensics, in particular to a write protection lock for a hard disk in the Windows environment. The write protection lock comprises a USB unit, a loading program deposited in the sector 0 of the USB unit, a hard disk write-protection lock program deposited in the hidden sector of the USB unit. The loading program monitoring Windows operation system intermits the read-write of an objective hard disk through INT13H; when a computer is started up, the hard disk write protection lock program is embedded into the Windows operation system. The hard disk write-protection lock program monitoring Windows operation system reads and writes the objective hard disk through a drive program, and redirects write operation to the UBS unit, thereby preventing the data on the hard disk from being modified. The write protection lock is designed originally; no additional hardware units are needed between a computer motherboard and the hard disk. The service cost is low, and just one USB unit supporting the start-up from USB is needed; the use value is high; the write protection lock can be used as a running platform for computer crime forensics software.

Description

technical field [0001] The present invention relates to the field of computer forensics, and specifically provides a hard disk write protection lock based on a USB device in a Windows environment Background technique [0002] With the increasing degree of informatization, the phenomenon of computer crime is becoming more and more common. Compared with the evidence collection of ordinary crimes, computer crime forensics has a strong particularity. Computer data is generally stored on the local hard disk. Extracting valuable information from the computer hard disk is a research hotspot in computer crime forensics. Directly running the Windows operating system on the criminal's hard disk to reproduce the criminal's working environment will make the forensics work faster. and efficient; however, a hard disk write protection lock is required to prevent the Windows operating system from modifying data on the hard disk [0003] Currently existing hard disk write protection locks a...

AI Technical Summary

Problems solved by technology

[0003] Currently existing hard disk write protection locks are divided into two types. One is to add additional hardware devices between the computer motherboard and the hard disk. This type of solution is closely integrated with the hardware, and there are problems of high cost and compatibility. The other type needs to be installed on the hard disk. Install the hard disk write-protection lock program, the hard disk write-protection lock program will take effect after reboot

The installation process and working process of this type of hard disk protection lock have modified the data on the hard disk, affecting the judicial validity of the hard disk data.

Images