Is it possible to force a hard disk into 'write-once' mode in Windows?
I want to securely store logs so they can't be changed, but I can't use tapes or optical media due to performance reasons.
Is it possible to force a hard disk into 'write-once' mode in Windows?
I want to securely store logs so they can't be changed, but I can't use tapes or optical media due to performance reasons.
You can look at some storage appliances that have some WORM capability. EMC Centera, HP StoreAll 9000 series, and others all have some WORM capability. These aren't exactly cheap however.
The standard solution for this problem is to use a remote log server. In Windows you can use NTSysLog to forward system/security/application events to a remote syslog server.
Please bear in mind that log files are typically written to and appended, so write-once is not a great option. Put them in a read-only share, or set the permissions so that only the service writing to the logs can edit the folder. This will not protect them from an administrative user, but it will certainly stop 'casual' access to the log files.
Modified
date parameter needs to be changed. How would you do that if the disk is WORM? Create a new file into which you copy the old one plus the new contents? Would you accept to do this every time you want to append data to a file? Anyway, I don't think you can hope to achieve such a thing with NTFS...
Apr 3, 2013 at 15:40
Modified
date parameter on every write - only when the file is closed after being written to. Logging applications typically keep the current log file open until it is ready to roll to the next log file (because opening and closing on every write would severely impact performance