Tuesday, December 21, 2010

How to prevent a file on a USB drive from being accidentally deleted

I can't wait to try this answer:

http://www.experts-exchange.com/Storage/Storage_Technology/Q_23715466.html

Which says:

You can use NTFS file permissions to prevent casual users from inadvertently deleting files.

Format the stick with NTFS, then (assuming the stick is on E:) type the following console commands:

cd /d E:\
cacls . /T /G Everyone:R /G Administrator:F

Make sure to use "Administrator" and not the plural "Administrators". The former SID is worldwide unique to your computer, the latter isn't. This will allow only your PC to modify the stick.

There is no way to 100% prevent a determined user with admin on their box from modifying your files. A determined user can take ownership and override the ACL. But there will be evidence (the ACL has changed). It is hard to restore a foreign SID to hide the evidence of tampering, without using special tools.


For reference, here are the M$ KB pages for the cacls command and also cd /d which I hadn't seen before:

http://technet.microsoft.com/en-us/library/bb490872.aspx

http://support.microsoft.com/kb/162786

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/chdir.mspx?mfr=true