Write protection method for disk under Windows operating system

Abstract

The invention discloses a write protection method for a disk under a Windows operating system, which is characterized in that data at specific positions of a plurality of sectors of the disk are directly changed into specific values, so that when the Windows system loads the disk, the disk can be mounted in a read-only mode when encountering a mark, and the data in each partition can only be read and cannot be written or changed. The method has the advantages that the method is effective for both a fixed disk and a movable disk; the method is irrelevant to a file system, and write protection can be realized regardless of NTFS, ReFS, exFAT and FAT32 file systems; according to the method, write protection of the partition level instead of the file level is adopted, after setting, files in the file partitions cannot be modified, new files or folders cannot be created, file attributes cannot be modified, and even the partitions cannot be formatted; the method is high in compatibility, and the method is applicable as long as disk equipment which can be identified by Windows, physical equipment or virtual disk equipment, and the partition scheme is MBR or GPT which can be identified by Windows.

Description

Technical Field

[0001] The invention relates to a write protection method for a disk under a Windows operating system, and belongs to the technical field of information security. Background Art

[0002] In the field of electronic data forensics, there are strict requirements for the originality and integrity of data. It is necessary to use file, partition and even disk-level write protection technology to prevent data from being accidentally overwritten or deleted, and to prevent viruses or malware from destructive modifications to the system and data. For example, the appraisal opinion issued by the appraisal agency generally uses CDs and USB flash drives to store the attached files, and calculates the integrity check value of the content (the hash value of the file calculated using algorithms such as SHA-1) and records it in the appraisal opinion. In the subsequent links, the integrity check value of the file is recalculated when necessary. If it is consistent, it means that the data has not been tampered with. If it is inconsistent, it means that the data has been tampered with. However, the data in CDs, USB flash drives, and mobile hard drives can be easily modified when viewed, and the attributes of the file (such as access time) can also be easily updated when viewed. Once the integrity check value of the file changes, it means that the integrity and originality of the attachments to the appraisal opinion cannot be proved.

[0003] Currently, the common write protection methods are as follows: 1. Adding read-only attribute to files: The advantages are simple operation and strong versatility. The disadvantages are: the read-only attribute is not mandatory, and some software will ignore the read-only attribute of the file and continue to write to the file; the read-only attribute of the file can be removed very easily; the read-only attribute of the file can only constrain existing files and cannot prevent the creation of new files.

[0004] 2. Prohibit users from modifying permissions through permission control: This method is only effective for a small number of file systems such as NTFS and ReFS. File systems such as exFAT and FAT32 cannot set file permissions.

[0005] 3. Through customized hardware, install a physical write-protection switch on the USB flash drive and mobile hard disk to prevent data writing instructions: The advantage is that once the switch is turned on, the write protection is reliable. The disadvantage is that customized hardware is required, which is costly, and the switch can be easily turned off by mistake.

[0006] 4. Write protection through hardware read-only lock: The storage medium needs to be connected to the computer through a special device to prevent data writing instructions and protect the data. The disadvantage is that the read-only lock is expensive and is generally only equipped in professional electronic data forensics laboratories.

[0007] 5. Set the partition's write protection through the diskpart command line tool built into Windows: The disadvantage is that this command is only valid for "fixed storage" (such as the computer's built-in mechanical hard drive, solid-state drive, external large-capacity mobile hard drive), and cannot set write protection for "removable storage" (such as USB drives, memory cards, etc.). Summary of the invention

[0008] The technical problem to be solved by the present invention is to provide a safe, convenient, low-cost and highly compatible disk write protection method under the Windows operating system, which directly changes the data at specific positions of the first several sectors of the disk to a specific value, so that when the Windows system loads the disk, it will mount it in read-only mode when encountering this mark, thereby achieving the goal that the data in each partition can only be read but not written or changed.

[0009] The present invention is implemented through the following scheme: a write protection method for a disk under a Windows operating system, which directly changes the data at specific positions of several sectors of the disk to specific values, so that when the Windows system loads the disk, it will mount it in read-only mode when encountering this mark, thereby achieving that the data in each partition can only be read but not written or changed.

[0010] When the disk structure is the MBR partition scheme, change the byte 1025 to 1040 of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the byte 1048 of the disk to 0x10 (the corresponding decimal number is 16).

[0011] When the disk structure is the MBR partition scheme, change the byte 1025 to 1040 of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the byte 1048 of the disk to any value in the set {x|16≤x<32 or 48≤x<64}.

[0012] When the disk structure is the GPT partition scheme, search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. If a hit is found, change the 56th byte after the hit position to 0x10 (the corresponding decimal number is 16).

[0013] When the disk structure is the GPT partition scheme, search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. If a hit is found, change the 56th byte after the hit position to any value in the set {x|16≤x<32 or 48≤x<64}.

[0014] A method for writing protection of a disk under Windows operating system comprises the following steps: Step 1: Determine the partition scheme of the disk; Step 2: If the disk structure is MBR partition scheme, change the 1025th to 1040th bytes of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to 0x10 (corresponding to decimal number 16) or any value in the set {x|16≤x<32 or 48≤x<64}; Step 3: If the disk structure is GPT partition scheme, the following steps are included: Step a, search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. If there is a hit, change the 56th byte after the hit position to 0x10 or any value in the set {x|16≤x<32 or 48≤x<64}; Step b, treating the 17th to 20th bytes of the second sector of the disk as all zeros, and then calculating the CRC32 check value of the first 92 bytes of the second sector, and writing the 17th to 20th bytes of the second sector and the 17th to 20th bytes of the last sector of the disk in little-endian byte order; Step c, calculate the CRC32 checksum of the 3rd to 34th sectors of the disk, and write the 89th to 92nd bytes of the 2nd sector and the 89th to 92nd bytes of the last sector of the disk in little-endian byte order.

[0015] The method for determining the partition scheme of the disk in step 1 is as follows: read the 451st byte of the disk, if the content is 0xEE, the partition scheme is the GPT partition scheme, otherwise it is the MBR partition scheme.

[0016] Reinitialize the disk to the MBR partition scheme and divide the partitions. Then change the contents of sectors 1025 to 1040 of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to 0x10 (corresponding to decimal number 16) or any value in the set {x|16≤x<32 or 48≤x<64}.

[0017] Reinitialize the disk to the GPT partition scheme and partition it. Then search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. Change the 56th byte after the hit position to 0x10 (corresponding to decimal number 16) or any value in the set {x|16≤x<32 or 48≤x<64}.

[0018] Search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk, change the 56th byte after the hit position to 0x10 (the corresponding decimal number is 16) or any value in the set {x|16≤x<32 or 48≤x<64}, then directly change the 1025th to 1040th byte of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to 0x10 (the corresponding decimal number is 16) or any value in the set {x|16≤x<32 or 48≤x<64}.

[0019] The beneficial effects of the present invention are: 1. After the write protection is set, the user cannot remove it by himself, which can prevent the user from removing the write protection by mistake or malicious software. The write protection is not only effective on the current computer, but also remains in the write protection state when the disk is connected to other Windows computers; 2. The present invention is effective for both fixed disks and removable disks, whether they are built-in mechanical hard disks, solid-state hard disks, external mobile hard disks, USB flash drives, or various memory cards in a computer, and the write protection effect can be achieved after setting; 3. The method of the present invention has nothing to do with the file system, and can achieve write protection regardless of whether it is NTFS, ReFS, exFAT, or FAT32 file system; 4. The present invention is a write protection at the partition level rather than the file level. After setting, the files in the file partition cannot be modified, new files or folders cannot be created, file attributes cannot be modified, and even the partition cannot be formatted; 5. The method of the present invention has high compatibility. As long as it is a disk device that Windows can recognize (whether a physical device or a virtual disk device), as long as the partition scheme is MBR or GPT that Windows can recognize, this method is applicable; 6. The method of the present invention has low cost. DETAILED DESCRIPTION

[0020] The present invention is further described below, but the protection scope of the present invention is not limited to the described contents.

[0021] For the sake of clarity, not all features of an actual embodiment are described. In the following description, well-known functions and structures are not described in detail because they would obscure the invention with unnecessary detail. It should be recognized that in the development of any actual embodiment, a large number of implementation details must be made to achieve the specific goals of the developer, such as changing from one embodiment to another according to relevant system or relevant business limitations. In addition, it should be recognized that such development work may be complex and time-consuming, but it is merely routine work for those skilled in the art. Example 1

[0022] A method for writing protection of a disk under Windows operating system comprises the following steps: Step 1: Determine the partition scheme of the disk; Step 2: If the disk structure is MBR partition scheme, change the 1025th to 1040th byte of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to 0x10 (the corresponding decimal number is 16); Step 3: If the disk structure is GPT partition scheme, the following steps are included: Step a: Search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. If a hit is found, change the 56th byte after the hit position to 0x10 (the corresponding decimal number is 16).

[0023] Step b, treating the 17th to 20th bytes of the second sector of the disk as all zeros, and then calculating the CRC32 check value of the first 92 bytes of the second sector, and writing the 17th to 20th bytes of the second sector and the 17th to 20th bytes of the last sector of the disk in little-endian byte order; Step c, calculate the CRC32 checksum of the 3rd to 34th sectors of the disk, and write the 89th to 92nd bytes of the 2nd sector and the 89th to 92nd bytes of the last sector of the disk in little-endian byte order. Example 2

[0024] A method for writing protection of a disk under Windows operating system comprises the following steps: Step 1: Determine the partition scheme of the disk; Step 2: If the disk structure is MBR partition scheme, change the 1025th to 1040th bytes of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to any value in the set {x|16≤x<32 or 48≤x<64}; Step 3: If the disk structure is GPT partition scheme, the following steps are included: Step a: Search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. If a hit is found, change the 56th byte after the hit position to any value in the set {x|16≤x<32 or 48≤x<64}.

[0025] Step b, treating the 17th to 20th bytes of the second sector of the disk as all zeros, and then calculating the CRC32 check value of the first 92 bytes of the second sector, and writing the 17th to 20th bytes of the second sector and the 17th to 20th bytes of the last sector of the disk in little-endian byte order; Step c, calculate the CRC32 checksum of the 3rd to 34th sectors of the disk, and write the 89th to 92nd bytes of the 2nd sector and the 89th to 92nd bytes of the last sector of the disk in little-endian byte order. Example 3

[0026] A method for writing protection of a disk under Windows operating system comprises the following steps: Step 1: Determine the partition scheme of the disk; Step 2: If the disk structure is MBR partition scheme, change the 1025th to 1040th byte of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to 0x10 (the corresponding decimal number is 16); Step 3: If the disk structure is GPT partition scheme, the following steps are included: Step a: Search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. If a hit is found, change the 56th byte after the hit position to any value in the set {x|16≤x<32 or 48≤x<64}.

[0027] Step b, treating the 17th to 20th bytes of the second sector of the disk as all zeros, and then calculating the CRC32 check value of the first 92 bytes of the second sector, and writing the 17th to 20th bytes of the second sector and the 17th to 20th bytes of the last sector of the disk in little-endian byte order; Step c, calculate the CRC32 checksum of the 3rd to 34th sectors of the disk, and write the 89th to 92nd bytes of the 2nd sector and the 89th to 92nd bytes of the last sector of the disk in little-endian byte order. Example 4

[0028] A method for writing protection of a disk under Windows operating system comprises the following steps: Step 1: Determine the partition scheme of the disk. The determination method is as follows: Read the 451st byte of the disk. If the content is 0xEE, the partition scheme is GPT, otherwise it is MBR. Step 2: If the disk structure is MBR partition scheme, change the 1025th to 1040th bytes of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to any value in the set {x|16≤x<32 or 48≤x<64}; Step 3: If the disk structure is GPT partition scheme, the following steps are included: Step a: Search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. If a hit is found, change the 56th byte after the hit position to 0x10 (the corresponding decimal number is 16).

[0029] Step b, treating the 17th to 20th bytes of the second sector of the disk as all zeros, and then calculating the CRC32 check value of the first 92 bytes of the second sector, and writing the 17th to 20th bytes of the second sector and the 17th to 20th bytes of the last sector of the disk in little-endian byte order; Step c, calculate the CRC32 checksum of the 3rd to 34th sectors of the disk, and write the 89th to 92nd bytes of the 2nd sector and the 89th to 92nd bytes of the last sector of the disk in little-endian byte order. Example 5

[0030] Reinitialize the disk to the MBR partition scheme and divide the partitions. Then change the contents of sectors 1025 to 1040 to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to 0x10 (the corresponding decimal number is 16). Example 6

[0031] Reinitialize the disk to the MBR partition scheme and divide the partitions. Then change the contents of sectors 1025 to 1040 to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change byte 1048 to any value in the set {x|16≤x<32 or 48≤x<64}. Example 7

[0032] Reinitialize the disk to the GPT partition scheme and partition it. Then search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk and change the 56th byte after the hit position to 0x10 (the corresponding decimal number is 16). Example 8

[0033] Reinitialize the disk to the GPT partition scheme and partition it. Then search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. Change the 56th byte after the hit position to any value in the set {x|16≤x<32 or 48≤x<64}. Example 9

[0034] Search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk, change the 56th byte after the hit position to 0x10 (the corresponding decimal number is 16), then directly change the 1025th to 1040th byte of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to 0x10 (the corresponding decimal number is 16). Example 10

[0035] Search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk, change the 56th byte after the hit position to any value in the set {x|16≤x<32 or 48≤x<64}, then directly change the 1025th to 1040th byte of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to any value in the set {x|16≤x<32 or 48≤x<64}. Embodiment 11

[0036] Search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk, change the 56th byte after the hit position to 0x10 (the corresponding decimal number is 16), then directly change the 1025th to 1040th byte of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to any value in the set {x|16≤x<32 or 48≤x<64}. Example 12

[0037] Search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk, change the 56th byte after the hit position to any value in the set {x|16≤x<32 or 48≤x<64}, then directly change the 1025th to 1040th byte of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to 0x10 (the corresponding decimal number is 16).

[0038] The above changes are only minimal changes, not all changes. For example, directly changing the contents of sectors 1025 to 1048 of the MBR disk to 0xA2A0D0EBE5B9334487C068B6B72699C711111111111111110 also falls within the scope of this patent.

[0039] Although the technical solutions of the present invention have been described and listed in detail, it should be understood that it is obvious to those skilled in the art to make modifications to the above embodiments or adopt equivalent alternatives. These modifications or improvements made without departing from the spirit of the present invention are within the scope of protection required by the present invention.

Claims

1. A method for writing protection of a disk under Windows operating system, characterized in that: Directly change the data at specific locations of several sectors of the disk to specific values, so that when the Windows system loads the disk, it will mount it in read-only mode when it encounters this mark.

2. A method for writing protection of a disk under Windows operating system according to claim 1, characterized in that: When the disk structure is the MBR partition scheme, change the disk byte 1025 to 1040 to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the disk byte 1048 to 0x10.

3. The method for writing protection of a disk under Windows operating system according to claim 1, characterized in that: When the disk structure is the MBR partition scheme, change the byte 1025 to 1040 of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the byte 1048 of the disk to any value in the set {x|16≤x<32 or 48≤x<64}.

4. The method for writing protection of a disk in Windows operating system according to claim 1, characterized in that: When the disk structure is the GPT partition scheme, search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. If a hit is found, change the 56th byte after the hit position to 0x10.

5. The method for writing protection of a disk in Windows operating system according to claim 1, characterized in that: When the disk structure is the GPT partition scheme, search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. If a hit is found, change the 56th byte after the hit position to any value in the set {x|16≤x<32 or 48≤x<64}.

6. The method for writing protection of a disk in Windows operating system according to claim 1, characterized in that: The following steps are included: Step 1: Determine the partition scheme of the disk; Step 2: If the disk structure is MBR partition scheme, change the byte 1025 to 1040 to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the byte 1048 to 0x10 or any value in the set {x|16≤x<32 or 48≤x<64}; Step 3: If the disk structure is GPT partition scheme, the following steps are included: Step a, search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. If there is a hit, change the 56th byte after the hit position to 0x10 or any value in the set {x|16≤x<32 or 48≤x<64}; Step b, treating the 17th to 20th bytes of the second sector of the disk as all zeros, and then calculating the CRC32 check value of the first 92 bytes of the second sector, and writing the 17th to 20th bytes of the second sector and the 17th to 20th bytes of the last sector of the disk in little-endian byte order; Step c, calculate the CRC32 checksum of the 3rd to 34th sectors of the disk, and write the 89th to 92nd bytes of the 2nd sector and the 89th to 92nd bytes of the last sector of the disk in little-endian byte order.

7. A method for writing protection of a disk in Windows operating system according to claim 6, characterized in that: The method for determining the partition scheme of the disk in step 1 is as follows: read the 451st byte of the disk, if the content is 0xEE, the partition scheme is the GPT partition scheme, otherwise it is the MBR partition scheme.

8. The method for writing protection of a disk in Windows operating system according to claim 1, characterized in that: Reinitialize the disk to the MBR partition scheme and divide the partitions. Then change the contents of sectors 1025 to 1040 of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to 0x10 or any value in the set {x|16≤x<32 or 48≤x<64}.

9. The method for writing protection of a disk in Windows operating system according to claim 1, characterized in that: Reinitialize the disk to the GPT partition scheme and partition it. Then search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk. Change the 56th byte after the hit position to 0x10 or any value in the set {x|16≤x<32 or 48≤x<64}.

10. The method for writing protection of a disk in Windows operating system according to claim 1, characterized in that: Search for 0xA2A0D0EBE5B9334487C068B6B72699C7 in the first 34 sectors of the disk, change the 56th byte after the hit position to 0x10 or any value in the set {x|16≤x<32 or 48≤x<64}, then directly change the 1025th to 1040th byte of the disk to 0xA2A0D0EBE5B9334487C068B6B72699C7, and change the 1048th byte of the disk to 0x10 or any value in the set {x|16≤x<32 or 48≤x<64}.