Locking individual files onto usb to avoid deletion

Question

Locking individual files onto usb to avoid deletion

I would like to put a movie file on to USB keys distributed promotionally and thusly would like to lock the file so that people who receive can't easily delete it.

I don't mind much if it's something that can be circumvented but I'd like to make it at least difficult. I tried checking the lock option in the get info window but this does not prevent the file being moved to trash from the usb and only when the trash is emptied is any mention made of any locking and it merely asks if you would like to delete it anyway.

I tried looking at the permissions of the file in get info on the machine where the file is located prior to copying to the USB but changing these permissions does nothing and it is still easily deletable. How can I achieve this and also, incidentally what is the point of the lock option if all it does is ask people if they mind that the file is locked? If it's only a matter of saying you don't care that it's locked go ahead and delete it anyway, why bother?

Mac Pro, Mac OS X (10.6.6)

Posted on Feb 2, 2011 5:38 AM

Reply

Answer 1

varjak paw

Level 10

170,200 points

Feb 2, 2011 6:53 AM in response to lightlySalted

The lock option in Finder is only to help someone avoid mistakenly deleting or overwriting a file. It's not intended as any sort of strong security.

I don't know any way you can lock something on a USB flash drive that the user's can't defeat pretty easily. Why do you not burn the file onto a CD-R or DVD-R? Then it can't be deleted by any means (short of smashing the disk).

Regards.

Reply

Answer 2

ajduguid

Level 3

650 points

Feb 2, 2011 7:01 AM in response to lightlySalted

I'm not entirely sure about this but what about burning a CD-R with the video on it. Then, create an iso image of the disk and restore that image to the USB drive.

My thinking, and I could be wrong, is to create an image of the file system used by CD-Rs which believe is read-only. Don't have a real disk handy to test this out with at the moment.

Reply

Answer 3

varjak paw

Level 10

170,200 points

Feb 2, 2011 7:09 AM in response to ajduguid

The read-only status would only apply to the disk image itself; read-only status is not a property of the files themselves and would not carry over when the files are copied to another place. Hence once the image was "restored" to a flash drive it would be read-write, so the files could be deleted as normal.

Regards.

Reply

Answer 4

Limnos

Level 10

411,121 points

Feb 2, 2011 7:16 AM in response to lightlySalted

It's up to you if this is even worth considering but some USB key drives have a lock switch. If you locked it, then disabled the switch (epoxy glue comes to mind)...?

Reply

Answer 5

ajduguid

Level 3

650 points

Feb 2, 2011 7:37 AM in response to lightlySalted

Here you go, this is the solution. What it will do is create a read-only USB drive using the image of a CD.

Format you USB drive as normal and add the files you want.

Launch Disk Utility, highlight your pen drive and create a New Image, selecting DVD/CD master as the Image format.

Then launch Terminal, navigate to where you saved the image (which will end in cdr) and use the following command.


hdiutil makehybrid -iso -joliet -o test.iso test.cdr

So now we have a test.iso file, test being what I called the image.

Keeping Terminal open, eject the USB drive and back in Terminal use


diskutil list

Plug the USB drive back in and repeat. What you will now know is the disk number used to identify the USB device, so in my case the additional device that showed up from using the command the second time was /dev/disk4

Now issue the following command in Terminal


diskutil unmountDisk /dev/disk4

obviously replacing disk4 with whatever number you identified in your case.

Now the neat part


sudo dd if=test.iso of=/dev/rdisk4 bs=1m

This writes the iso image to the USB drive and once it is finished you can mount the USB drive again and it will come up with a read-only partition in the ISO 9660 format. Like any disk you burn it will have 0 space free and the only thing you can do is read or wipe the partition.

Reply

Answer 6

ajduguid

Level 3

650 points

Feb 2, 2011 7:39 AM in response to varjak paw

Nope, it's definitely do-able, see my post below (or above depending if you view this threaded or not).

Reply

Answer 7

Feb 2, 2011 8:31 AM in response to ajduguid

This is promising. It looks quite technical but I can probably give that a shot.

I'm only just realising that what I'm trying to do is actually a much more difficult task than I realised. Just so that others know, I can't use dvd's or cd's as an alternative because the purpose of these usb keys is promotional, they have our branding on them, they don't have a read write switch and the hope is that the usefulness of a usb key that the client can keep which also contains a showreel (the movie file) of our work will keep us in their minds.

So while I was waiting for a response to this thread I cam to realise that partitioning was perhaps my only option as ajdguid seems to be suggesting here. One question though, if I go this root with making an image, will this still appear as a movie file that a non-savvy operator can simply see on the root and watch or will it involve complicated mounting procedures? Mounting images on a mac is a pretty simple process but in windows one is likely to need to know what an image is and probably need to have software to mount it. I don't mind so much if upon insertion, the two partitions of the disk come up as if there were two removable devices attached so long as on one of those partitions one can just see a file sitting on the disk which is our showreel and click on it but also be unable to delete it.

Also ajduguid your post is pretty self explanatory for the most part but I'm not fluent in terminal, would you be kind enough to explain what each stage is doing? I think I pretty much know but having it confirmed would make me feel more secure. Is it possible I can do these steps in disk utility with the GUI or does have to be done in terminal?

EDIT: Sorry I should mention I want the file to be undeletable but the rest of the disk should be usable

Message was edited by: lightlySalted

Reply

Answer 8

ajduguid

Level 3

650 points

Feb 2, 2011 8:42 AM in response to lightlySalted

So a couple of questions in there.

1. When I plug in the finished USB device it mounts automatically without any additional effort, the only difference is the filesystem is read only. The steps will make the rest of the USB unusable but is that a problem? Just to be clear, it mounts like any device, shows up with whatever files you had on the device with no change the only difference from a normal formatted USB device being it can't be written to which of course also covers deleting.

I'll try my best with the different parts.

The Disk Utility part at the start is about creating a master image you can use to burn disks, this doesn't seem to be enough in it's current form.

The hdiutil command converts this to a more typical ISO image so in all intents and purposes it is now a bit for bit image of a read only CD.

The diskutil commands are to identify which device represents the USB device you want to work on. Every device has a pointer like this. Your internal drive for example will probably be /dev/disk0 like mine is. Got a CD or DVD in the drive? it will have a disk id associated with it. What those commands are doing is to make it easy to identify what the id used for the device you just inserted.

Once you have done that you need to unmount the device but still have it connected to the machine. At this point you can perform raw writes to the device.

Then the last command, sudo dd is actually two commands. The sudo, which you will need to do from an Administrator account (which I'm assuming is in your case) escalates the next command to be issued with root privileges. The reason you need to do this is that the dd is, working at the level of bits on the device, replacing *everything on the of (output file is a bit misleading as the file we're pointing at is in fact the pointer to a real device rather than a normal file) and replacing everything on of with whatever you point at with if. So we replace everything on the USB device with the iso image which of course is read only as it was never designed to be writeable.

Does that help?

Edit
Sadly the Terminal commands do have to be done at a prompt. I'm assuming you're happy in changing directories in Terminal and it's only the more obscure parts you're unsure about. Tell me if that isn't the case.

Message was edited by: ajduguid

Reply

Answer 9

Feb 2, 2011 9:02 AM in response to ajduguid

thank you so much. I think we're on the right track here. I went ahead with the commands. They're not so scary.

As I want the rest of the disk other than this file to be writable I added my own steps to the procedures and thought it would work but it hasn't. What I did before starting on your section was:

I partition the usb key in to two partitions one roughly 300 mb the other 3.7GB (the remainder of the key) then made an image as you said, but of the small partition which included the movie file that I wanted to be undeletable. From there I followed every step of your instructions however the result has been odd.

I now have only a single partition on the disk, it is 3.7 GB in size and the file is nowhere to be seen, no image has mounted and I guess only the larger partition is mounting and so I have a usb key with out the file I want and it's 300GB smaller in capacity.

Was I on the right track with my changes to the procedure? Where did I go wrong? I should also point out that I also changed the step:

"sudo dd if=test.iso of=/dev/rdisk4 bs=1m"

to "sudo dd if=test.iso of=/dev/rdisk2s1 bs=1m"

to reflect the fact that in my case it is disk 2 and also the s1 to indicate the first smaller 300 mb partition.

Reply

Answer 10

ajduguid

Level 3

650 points

Feb 2, 2011 9:11 AM in response to lightlySalted

I'm not sure if you're going to be able to do what you want I'm afraid. The dd command, because it's writing the iso image bit for bit will overwrite the partition information - the whole lot. By pointing it to the first partition you'll have created some weird and probably unreadable device as what it won't be expecting at the start of the partition is another partition scheme.

Edit
Certainly you seem to be getting the idea though if you feel comfortable enough experimenting like you did. I'll have to give a think to what you're trying to achieve.

Edit 2
My thinking right now is maybe, and I really mean maybe, gparted (linux partition program) may allow you to create what you want and then once you have done it once you create an image you can push onto the others much like how the dd command is already doing.

Message was edited by: ajduguid

Reply

Answer 11

Feb 2, 2011 9:10 AM in response to lightlySalted

I have a USB drive that I received as a promotional give away from the old Cingular wireless.

The drive has a little, mechanical switch on it to allow it to be locked.

That leads me to believe, that if you are making enough of these drives, you might be able to work with the manufacturer to enable them to be locked. Or perhaps locked unless someone truly wants to overwrite it for other purposes.

Matt

Reply

Answer 12

Feb 2, 2011 9:19 AM in response to ajduguid

What happens if I make an image of the folder containing the file that I wish to copy to the usb rather than an image of the partition on the disk with the file residing inside it? This folder wouldn't contain any partition information presumably and so couldn't overwrite the partition information on the disk.

It seems that the partition scheme I created hasn't been entirely lost, the size division is intact and even the name 'disk2s1' is visible as a partition in disk utility but it is greyed out and unmountable both from terminal and disk utility. Actually the name is strange because I thought that was what would be used to specify for the dd command where to write the information to on the disk (as in, which partition) but it has actually renamed this partition to the name 'disk2s1' when before it was in fact called UNTITLED 1. I find this pretty weird, I think I'm not quite grasping the finesse of this.

Anyway, while I it is becoming apparent how much more complex a task what I'm trying to do is then what I originally envisioned (I thought I'd simply need to check a box that said lock or at most change permission to read only) I'm still finding it hard to wrap my head around the idea that it's unachievable. Didn't sandisk usb's contain some infuriating thing called santools or something which was undeletable? And I'm pretty sure western digital drives also have something similar on their 'passport' portable hard drives. Do they have some kind of custom firmware or something?

Reply

Answer 13

Feb 2, 2011 9:27 AM in response to lightlySalted

Working out such a deal might have been a nice idea but alas this may be a one off thing, at the very least it probably won't be done again for some time and not until we've used up all of these ones. Also, a read/write switch leaves open the possibility of somebody switching it write. I don't need these things to be as secure as for knox but if I see a switch on the drive, I'm going to switch if only just to see what it does and if it has 'read/write' written on it then I'll definitely switch it to write on principle.

You might say perhaps I ought to have worked all this out before 100 of these keys were ordered but I wasn't actually involved in that I was just asked to please 'lock a file to these' and also I probably would have made the same mistake because it genuinely never occurred to me that such a seemingly simple idea would turn out to be so difficult. I guess I can understand why but it does still surprise me how little there is by way of precedent for such an application. Surely people must do this all the time right? I'm having trouble finding any pre-made applications for this purpose be they GNU, freeware or commercial. What's up with that?

Plenty of encryption software, almost all of it PC but nothing seems to do this job and I would definitely have thought it were something people would try to do.

Reply

Answer 14

Feb 2, 2011 9:50 AM in response to lightlySalted

Well as you may or may not have been able to tell me, making the image file from a folder on the machine rather than on the USB key itself makes no difference and the end result is the same. The larger partition survives and mounts while the smaller partition is renamed and unmountable. Leaving you with a USB key minus a few hundred mb's capacity and none of the files you're trying to put on their in an undeletable protected state.

This is really frustrating.

Reply

Answer 15

Feb 2, 2011 9:52 AM in response to lightlySalted

It was suggested earlier. Is a DVD too small to hold this file?

Matt

Reply