The Notebook Review forums were hosted by TechTarget, who shut down them down on January 31, 2022. This static read-only archive was pulled by NBR forum users between January 20 and January 31, 2022, in an effort to make sure that the valuable technical information that had been posted on the forums is preserved. For current discussions, many NBR forum users moved over to NotebookTalk.net after the shutdown.
Problems? See this thread at archive.org.

    Confirming files haven't been added to USB drives

    Discussion in 'Windows OS and Software' started by Generic User #2, Jul 4, 2011.

  1. Generic User #2

    Generic User #2 Notebook Deity

    Reputations:
    179
    Messages:
    846
    Likes Received:
    0
    Trophy Points:
    30
    I was wondering there is an OS function or program that will allow you to 'take a snapshot' of a USB drive and then at a later time, scan the USB drive and show what files were added/modified.

    I'm asking because sometimes I have to pass around a USB drive around class(no, I can't always use an online/networked solution) and I want to be able to make sure that no one has added any malicious files(intentionally or cause they're infected) to the USB drive.

    my use case would be:
    1) add the file I want to share to the USB drive
    2) 'take a snapshot'
    3) share the file
    4) check the USB drive for modification

    anything like this? I would prefer it if I didn't have to boot into a VM.
     
    Generic User #2, Jul 4, 2011
    #1
  2. newsposter

    newsposter Notebook Virtuoso

    Reputations:
    801
    Messages:
    3,881
    Likes Received:
    0
    Trophy Points:
    105
    just scan the thing with malwarebytes or something like that......
     
    newsposter, Jul 4, 2011
    #2
  3. olyteddy

    olyteddy Notebook Deity

    Reputations:
    468
    Messages:
    1,369
    Likes Received:
    0
    Trophy Points:
    55
    Wouldn't one of the file syncing programs allow you to do this?
     
    olyteddy, Jul 4, 2011
    #3
  4. Generic User #2

    Generic User #2 Notebook Deity

    Reputations:
    179
    Messages:
    846
    Likes Received:
    0
    Trophy Points:
    30
    is malwarebytes going to stop the drive from auto-running?

    what file-syncing programs?
     
    Generic User #2, Jul 4, 2011
    #4
  5. newsposter

    newsposter Notebook Virtuoso

    Reputations:
    801
    Messages:
    3,881
    Likes Received:
    0
    Trophy Points:
    105
    shutdown autorun on your computer.

    Drives don't auto-run on their own......

    Computers with an auto-run setting runs the autorun.inf file.
     
    newsposter, Jul 4, 2011
    #5
  6. michael_recycled

    michael_recycled Notebook Deity

    Reputations:
    329
    Messages:
    989
    Likes Received:
    0
    Trophy Points:
    30
    perhaps checksums are what you are looking for. Have a look at md5summer for example.

    Michael
     
    michael_recycled, Jul 5, 2011
    #6
  7. lbohn

    lbohn Notebook Consultant

    Reputations:
    320
    Messages:
    235
    Likes Received:
    0
    Trophy Points:
    30
    Perhaps a USB drive with a write-protect switch?

    http://www.newegg.com/Product/Product.aspx?Item=N82E16820709018 (drives up to 128GB with switches can also be found)

    An infected machine would be unable to install files, however it's possible a malicious user could unlock the switch, install malware and reset the switch. A MD5 hash, as michael_recycled suggested, would reveal those changes.

    FYI Microsoft pushed out a WU update disabling AutoRun-on-USB-drives for all properly updated Windows installations including XP, earlier this year.

    http://blogs.technet.com/b/msrc/arc...into-the-security-advisory-967940-update.aspx

    --L.
     
    lbohn, Jul 5, 2011
    #7