USB Write Protect Defeating

VMware

There is a trend to block USB ports in corporate computers. For sure there are some security arguments to do so… What is interesting, there is simple method to bypass this protection e.g by vmware tool. Virtualization is becoming more popular and necessary in our work, and often virtualization software is installed. Even if machine has USB ports set to read only, when you mount external drive from vmware virtual machine you can use USB port in full read and write mode.

In forensics two example application can be:

1. Knowledge to always analyze virtual machines and applications, hopefully it is becoming standard.


2. In live Forensic it can be fast method to copy captured data from evidence machine when all other possibilities are blocked.