Write Protected Bootable USB Stick

Hey there,

is there any way of making USB stick bootable when it is write protected(by switch)? I have several sticks and tried several OS'es on them, but they all fail to boot when i write-protect my pendrive, while working perfectly fine when the drive is unlocked. It seems kinda awkward, when compared to bootable live CD's, which do not require to write anything.

The second thing I want to ask about - I am looking for a fast, small (max 2GB) bootable distro that will boot and work on as many computers as possible, ie. probably having lots of preinstalled drivers. It needs to automatically detect and config simple network, must have r/w access to NTFS drives, ability to detect printers, internet browser, office, and some basic tools. And it should be easy enough for pure-windows person to use it as OS/data backup.

Hey there,
 
is there any way of making USB stick bootable when it is write protected(by switch)? I have several sticks and tried several OS'es on them, but they all fail to boot when i write-protect my pendrive, while working perfectly fine when the drive is unlocked. It seems kinda awkward, when compared to bootable live CD's, which do not require to write anything.
 

Sure it is possible , anything that boots entirely in RAM should do, but of course it might depend on the specific stick and the actual OS that you boot, as an example Windows/PE's might want to anyway write the Disk Signature (if there isn't any) and fail in booting.
You need to be more specific, provide some detailed report of the hardware and setup involved, etc., etc....

The second thing I want to ask about - I am looking for a fast, small (max 2GB) bootable distro that will boot and work on as many computers as possible, ie. probably having lots of preinstalled drivers. It needs to automatically detect and config simple network, must have r/w access to NTFS drives, ability to detect printers, internet browser, office, and some basic tools. And it should be easy enough for pure-windows person to use it as OS/data backup.

Well, while you are at it, it should also do some coffee (black strong, two spoon of sugar for me, please) .
More seriously, what you described is a "vague" limitless superOS capable of doing *anything* on *any* hardware.

Are you thinking of a Linux distro or about a PE?
Both can do some of that, probably most of that,  but you cannot realistically expect to find such a "wide use" multi-tool, additionally fitting in less than 2 Gb.


Wonko

Hey there,

is there any way of making USB stick bootable when it is write protected(by switch)? I have several sticks and tried several OS'es on them, but they all fail to boot when i write-protect my pendrive, while working perfectly fine when the drive is unlocked. It seems kinda awkward, when compared to bootable live CD's, which do not require to write anything.

Heya, thanks for answers.

A CD is not only "write protected", but each and every file has the ro attribute set as well.

When you flip the switch on your USB-Stick, it can not be written to any longer, however the file attributes do not get set to ro.

So the OS expects the file to be writable, but the write access attempt fails and this causes the OS to crash.

Fix the file attributes and the OS will not crash. (Given that it runs fine from CD!)

Tried that, but it did not help. After some testing I am almost convinced that when write protection switch is beeing turned on, flash stick is not beeing detected as bootable. The whole detection procedure is skipped and it starts from HDD just like my flash drive would be normal storage device. Of course it boots from that flash when I set it to writeable mode.

You need to be more specific, provide some detailed report of the hardware and setup involved, etc., etc....

I have tried this on 4 PC's, each of different era, with probably every BIOS setting and the problem is persistent. Stick details: PQI 4GB USB 2.0 model: U339.

OS is custom nix version that is normally used as Live CD with option to use it as Live USB.

More seriously, what you described is a "vague" limitless superOS capable of doing *anything* on *any* hardware.

Are you thinking of a Linux distro or about a PE?
Both can do some of that, probably most of that,  but you cannot realistically expect to find such a "wide use" multi-tool, additionally fitting in less than 2 Gb.

ROFL

Basically I want as small as possible, as fast as possible, as realiable as possible linux based distro that can be used as both secondary OS and recovery tool for NTFS Windows machines. Hence, it needs drivers to boot properly into various kinds of machines and needs to have ability to operate on NTFS drives. Also I want it to load and configure network and printer drivers by itself. Then just basic office software, browser, pdf-reader, calculator, etc. I don't think that its that much, IMO almost any distro offers that. What I need is "out of box" solution, easy to set, easy to use(for somebody who is only familiar with Windows) but also fast, tested and realiable.

Of course multiboot is always option, and in fact I might be trying to load few compact distros at once, in case of one or another failing on some system, so that's why I am space limited, but since the smallest stick I own is 4GB, there should be plenty space for everything.

Edited by popov, 24 March 2013 - 02:03 AM.

Tried that, but it did not help. After some testing I am almost convinced that when write protection switch is beeing turned on, flash stick is not beeing detected as bootable.

Well, it would be the first time we see such a thing.

This one?

http://www.newegg.co...N82E16820141485

How (exactly) did you partition/format the stick?

Which tool, under which OS, with which settings?

Which is your "primary" bootloader?

Is it installed to the MBR (+hidden sectors, examples GRUB, grub4dos GRUB2) or it is in the PBR?

If the latter which MBR code is used?

AFAIK, apart the nice feature of the write protect switch, it uses a "common" USBest UT163 or UT165, nothing particularly "strange".

Wonko 

Yes, that's the one I'm using. Under Windows XP I have installed LPS(lightweight portable security) with their own installer that automatically formatted device. There is no bootloader, it's the only thing that is on the stick.

And yes, the stick itself stinks, I am using it just because of the switch. I would get something better, but it seems that write protected drives are very rare these days.

Another thing, I will be making multiboot flash stick(different than one above), and I am wondering what to use to format and build everything. It will be made (preferably) under Windows XP, and will have one main distro(with its own write storage, like Mint), small fast-launching distro for browsing net(like xPUD but recent), some basic diagnostic and recovery tools for both WinXP and Win7 and all that standard HDD/Memory/etc tools that are there on recovery CD's. I could even add MS-DOS, PicoXP and such just for fun, but the thing needs to start rolling first. As for now, I am somehow stuck.

The point is, some distros need to be installed in much different way than others, which complicates everything. This is especially true for all those distros that come with their own installers, like Slax. So I'd like to ask for a preffered tool, which could do it.

Edited by popov, 24 March 2013 - 09:14 PM.

Yes, I can confirm that sticks with the switch are very rare nowadays.

So, ALL your bootability tests (from which you derived your conclusions) are made with a single *something*, which you don't even know how partitions/formats the stick and WHICH booting approach uses?

Maybe you should try that stick with "something else" (known) and see how it behaves .

The general idea (with Linux based distro's) is to actually (whenever possible), NOT to install anything but use a .iso "as is".

What most people uses nowadays are either Syslinux or grub4dos.

There are several tools/utilities to partition/format the stick (and compatible with either of those two bootmanagers).

Just browse/search the board and you will find many examples/tutorials, etc., check the stickies first.

Wonko

Okay, that single something runs on isolinux with huge initrd beeing its main component. The point is, thing has it own installer, I can format drive using it(which is recommended), or format it by myself.

This is content of main isolinux.cfg file:

timeout 0
default vmlinuz
append initrd=initrd  splash=silent,theme:lps load_ramdisk=1 ramdisk_blocksize=4096 root=/dev/ram0 ramdisk_size=524288 console=tty1 loglevel=3 LM=4
display product.txt

But, there is a folder called InstalltoUSB, which contains syslinux, and here is its cfg:

timeout 0
default vmlinuz
append initrd=initrd  splash=silent,theme:lps load_ramdisk=1 ramdisk_blocksize=4096 root=/dev/ram0 ramdisk_size=524288 console=tty1 loglevel=3 LM=2
display product.txt

What else? Installation bat file is scripted like this:

@echo off
cls
:: Rich Kutter, CISSP
:: Install LPS to a USB thumb drive
::
:: Design:
::  Gather user input
::  Verify correctness - verify file locations
::  {Format}
::  Copy files
::  Install Linux boot loader
::
:: ATSPI_Outreach@wpafb.af.mil for help/support
:: http://spi.dod.mil
set CDROM=
set SRC_PATH=InstallToUSB
set SUP_PATH=%SRC_PATH%\Support


:: BEGIN
echo.
echo Batch file to install LPS to a USB storage device
echo.
echo         Brought to you by the ATSPI Technology Branch
echo                     http://spi.dod.mil
echo.
echo Summary of process:
echo    Format USB drive (optional)
echo    Copy required files
echo    Install Linux boot loader
echo.
echo Prepare to enter the drive letter of the source and target media

::CHECK FOR ADMIN RIGHTS
%CDROM%\%SUP_PATH%\IsAdmin.exe
if "%errorlevel%"=="0" goto :notadmin

pause
cls
:: GET USER INPUT
set /P CDROM="Enter drive letter of source disc (often CD-ROM, but could be USB): "
IF NOT '%CDROM%'=='' SET CDROM=%CDROM:~0,1%
set CDROM=%CDROM%:

echo.
set USB=
set /P USB="Enter drive letter of USB flash drive: "
IF NOT '%USB%'=='' SET USB=%USB:~0,1%
set USB=%USB%:



echo.
set FORMAT=
set /P FORMAT="Do you wish to format the USB drive (y/N): "
IF NOT '%FORMAT%'=='' SET FORMAT=%FORMAT:~0,1%

echo.
set EncWizard=
if not exist %CDROM%\EncryptionWizard goto notencwiz
set /P EncWizard="Do you wish to install Encryption Wizard to USB drive (y/N): "
IF NOT '%EncWizard%'=='' SET EncWizard=%EncWizard:~0,1%

echo.

:notencwiz

echo ***  Validating drives...  ***
:: VERIFY EXISTANCE OF DRIVES
if not exist %CDROM% goto driveerror
if not exist %USB% goto driveerror

:: VERIFY STRUCTURE OF CDROM
if exist %USB%\Windows goto windirerror

:: FORMAT USB DRIVE?
:: Example: HPUSBF.EXE e: -FS:FAT32 -Q -Y -V:LPS -S:\LPS
IF /I '%FORMAT%' neq 'Y' goto notformat
echo CDROM %CDROM% SRC_PATH %SRC_PATH%
%CDROM%\%SUP_PATH%\HPUSBF.EXE %USB% -FS:FAT32 -Q -V:LPS
IF NOT %errorlevel%==0 goto :formaterror

:notformat


:: COPY CONTENT TO USB STICK
echo.
echo ***  Copying content to USB device  ***
for %%X in (%SRC_PATH%) do (mkdir %USB%\%%X)
for %%X in (%SRC_PATH%) do (xcopy /v /s %CDROM%\%%X %USB%\%%X)

mkdir %USB%\Docs
xcopy /v /s %CDROM%\Docs %USB%\Docs
echo ***  Copying large files - please be patient  ***
copy /v %CDROM%\initrd %USB%\
copy /v %CDROM%\README* %USB%\
copy /v %CDROM%\%SRC_PATH%\syslinux\* %USB%\
copy /v %CDROM%\vmlinuz* %USB%\
copy /v %CDROM%\image.md5 %USB%\

:: INSTALL ENCRYPTION WIZARD?
IF /I '%EncWizard%'=='Y' mkdir %USB%\EncryptionWizard
IF /I '%EncWizard%'=='Y' xcopy /V /S %CDROM%\EncryptionWizard %USB%\EncryptionWizard

:: INSTALL LINUX BOOT LOADER
echo.
echo ***  Installing Linux Boot Loader  ***
%CDROM%\%SUP_PATH%\syslinux %USB%
IF NOT %errorlevel%==0 goto :bootloadererror

echo.
echo ***  Installation of LPS to USB device complete  ***
echo.
echo.
echo ***                 PLEASE NOTE                  ***
echo Your LPS USB device will NOT automount as a storage
echo device in LPS.  You are strongly encouraged to use
echo a separate USB device for data storage and disconnect
echo the boot device once the boot loader has finished
echo loading LPS.
echo ****************************************************
echo.

::END
goto eof

:: ERROR MESSAGES
:driveerror
echo.
echo.
echo ****   ERROR:   ****
echo One or more drives requested do not exist (%CDROM% or %USB%)
echo.
echo.
goto eof

:cdromerror
echo.
echo.
echo ****   ERROR:   ****
echo Verify file structure of CDROM or contact ATSPI_Outreach@wpafb.af.mil for
echo help
echo.
goto eof

:windirerror
echo.
echo.
echo ****   ERROR:   ****
echo Windows directory detected on %USB% - are you sure you want to install here?
echo.
echo Rename or remove %USB%\Windows and re-run the script
echo.
goto eof

:notadmin
echo.
echo.
echo ****   ERROR:   ****
echo Administrator rights are required to install the Linux boot loader to a USB
echo device and to (optionally) format the device.
echo.
goto eof

:formaterror
echo.
echo.
echo ****   ERROR:   ****
echo There was a problem formatting the USB device %USB%.  Ensure the device
echo is writable / formatable.
echo.
goto eof

:bootloadererror
echo.
echo.
echo ****   ERROR:   ****
echo There was a problem installing the Linux bootloader to %USB%.  Ensure the
echo device is writable.
echo.
goto eof

:: TERMINATE HERE
:eof
set CDROM=
set USB=
pause
 

Standard grub4dos ISo boot works fine for this distro

title LPS-1.4.0_public.iso MNU
map /LPS-1.4.0_public.iso (0xff)
map --hook
root (0xff)
chainloader (0xff)

Well, first thing the actual USB is never (properly) partitioned (which is an usual requirement to have more chances to boot *anything* ).

The batch seemingly uses the good ol' HP USB formatting utility, that has proved to work in a (largish) number of cases BUT also to fail in a number of other cases.

(please understand how there is no way to know what will work with what, the usual idea is to make a stick "as compatible as possible")

The Syslinux basically uses a "standard" MBR CODE (i.e. some code that looks for the Active primary partition in the partition table and chainloads it's bootsector), and by a Syslinux bootsector that loads the actual bootloader.

It is possible that Syslinux maps the device as HD and somehow "assumes" that it must be R/W.

As well it is possible that LPS (some setting in it) needs the write access for (example) writing a log or something like that.

You can easily add to your stick "as is" the grub.exe from grub4dos adding to syslinux.cfg a line calling it:

http://www.rmprepusb...inload-syslinux

then try either the entry Steve6375 just posted or a "flat file" approach like (on grub command line):

kernel /vmlinuz splash=silent,theme:lps load_ramdisk=1 ramdisk_blocksize=4096 root=/dev/ram0 ramdisk_size=524288 console=tty1 loglevel=3 LM=2
initrd /initrd
boot

get latest 0.4.5.c version of grub4dos here:

http://code.google.c.../downloads/list

Have a look to the grub4dos guide:

http://diddy.boot-la...os/Grub4dos.htm

at least:

http://diddy.boot-la...iles/basics.htm

http://diddy.boot-la...s/files/cli.htm

Wonko

:

To WP an NTFS pendrive, you can use diskpart to add the ReadOnly attribute to the disk. However, this will only protect it from writes under Vista/7/8 (not XP or linux).

As for what is 'best' 2Gb distro, it depends what you want to use it for - accessing Windows based systems and running Windows apps, or accessing linux systems and running linux apps.

Most people have both in their arsenal.

For a Windows like linux distro try StartOS (which can boot directly from an ISO and have persistence too).

Though it is considered Warez (stands well back and light the blue touch paper...)  Hirens DLC1 is pretty damn useful as it has a mini XP OS and a mini 7 OS.

gparted is pretty good for hardware - I would suggest backtrack5 as a good development OS, but it is too big for your criteria.

Another good WinPE project is Make_PE3.

Why not put them all on a decent USB stick?

P.S. SD cards have a 'lock' switch which is a write-protect switch. So if you buy a cheap USB SD card reader (these look like a USB stick and USB 2.0 ones cost peanuts) then you have your WP USB stick.

P.P.S. I booted LPS from an NTFS formatted WP SD card+reader and it booted fine - though very slowly! (using the grub4dos menu in post #10).

Thanks for answers, there are few things more I'd like to share:

while testing inside Virtual Box, LPS is detected and starts even when drive is write protected

the actual loader used by live USB installation is actually syslinux, while it seems that isolinux is there for live CD's

for LPS(more like testing LPS) I am just wiling to have separate write protected live USB stick

stick for multiboot with persistent distro/recovery tools is a different one, doesn't have/need write switch and won't include LPS

I had Hiren's winXP already, and I liked it as a repair tool for Windows XP, so now I am planning to have both WinXP and Win7 versions installed

about live linux distros with persistence mode, previously I really liked MooLux, because it booted on every machine I've tried it, and it properly configured everything(network, graphics, printers) in 90% of cases, while other, more popular distros failed me many times(currently I am testing Mint as main USB system, but it's one of slowest systems I ever had)

I don't want to build my own distro, just because my knowledge about linux drivers is very limited, there is no problem for me in building it for single desktop

from what I know SD cards only offer software write protection, while it's hardware on USB sticks

SD cards have a switch on them (hardware).

Well, I smiled, but according to this, it's not that simple:

http://www.fencepost...ite-protection/

SD Cards, while they have a write-protect switch, are actually no good for this purpose because it’s not actually hardware write protection – at best the card reader sends a signal to the operating system that the drive should be treated as read-only. The write-protect switch on the cards is read by a sensor that’s part of the card reader, and the card reader then passes along to the operating system whether the card is read-only. According to the specification from http://www.sdcard.org/:

A proper, matched, switch on the socket side will indicate to the host that the card is write-protected or not. It is the responsibility of the host to protect the card. The position of the write protect switch is unknown to the internal circuitry of the card.

In the same way that some USB Flash drives have a WP switch...   

In the same way that some USB Flash drives have a WP switch...

No, it's exactly the same. What  do you think is inside the card reader?

So moving the switch on an SD card is the same as moving the switch on a USB flash drive.

A WP signal is sent to the USB controller in both cases. The USB controller reports the media as Read Only.

No, it's exactly the same. What  do you think is inside the card reader?

So moving the switch on an SD card is the same as moving the switch on a USB flash drive.

A WP signal is sent to the USB controller in both cases. The USB controller reports the media as Read Only.

No, it is not, the analogy with the floppy RO switch is very correct.

The USB stick INCLUDES a controller that (unless the manufacturer is completely demented) CAN put the stick device in RO mode.

The switch is physically connected to the built in controller.

The issue with SD card is that the card "switch" tells the card reader that it should be treated as RO, BUT if the controller in the reader ignores this, the card will be RW anyway.

The switch on a sd card is nothing by a "notch", if there is not *something* sensing the position of this notch moved to the RO position the card will be seen normally.

If you prefer, a SD card on an adapter TESTED to have the RO sensor working is OK, but every time you insert a SD card in a new reader or new device, you are flipping a coin (at the most).

Wonko

Sure, but what was wanted was a USB stick with a WP switch. If you use a 'stick-form' SD card reader (as I pictured previously) + SD card then you have this. Further, the SD lock switch is inside the device and thus less likely to be fiddled with (especially if you glue the end cap on with the SD card still inside!). So I see no difference between a single USB stick with a WP switch and a single SD-reader+SD card!