Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to force a hard disk into 'write-once' mode in Windows?

I want to securely store logs so they can't be changed, but I can't use tapes or optical media due to performance reasons.

share|improve this question
    
you might want to explain who you are trying to secure the logs from. –  Alex P. Apr 1 '13 at 18:39
    
@AlexP. someone who might attempt to remove or alter log entries to cover up their tracks after an attack –  MurrayA Apr 1 '13 at 18:42
    
I meant mostly is it a remote attacker or a rogue insider - i.e. someone who has a legitimate user/admin access to the system. –  Alex P. Apr 1 '13 at 18:46
    
@AlexP. could be insider or outsider that has managed to gain elevated access –  MurrayA Apr 1 '13 at 18:51
3  
@MurrayA Probably best not to subject forests to that much logging :) –  Bryan Apr 1 '13 at 20:55

3 Answers 3

up vote 3 down vote accepted

You can look at some storage appliances that have some WORM capability. EMC Centera, HP StoreAll 9000 series, and others all have some WORM capability. These aren't exactly cheap however.

share|improve this answer
2  
I've accepted this answer as it's the only one that even comes close to providing a proper solution, and was what ultimately led me to find NetApp SnapLock software, which works with NetApp's OS called 'Data ONTAP'. –  MurrayA Apr 10 '13 at 10:23

The standard solution for this problem is to use a remote log server. In Windows you can use NTSysLog to forward system/security/application events to a remote syslog server.

share|improve this answer
1  
But how does that help to secure the logs on the remote log server? –  MurrayA Apr 1 '13 at 18:20
    
make it a dedicated log server. do not run any unnecessary services on it thus limiting the attack vectors. do not create user accounts either. –  Alex P. Apr 1 '13 at 18:34
    
that all helps of course, but I'm looking for something more. Ideally I want to make the storage write-once. –  MurrayA Apr 1 '13 at 18:40
2  
@MurrayA If you want write once media, you need to use write-once media. Crazy, I know. Typically this is done with a CD or DVD burner on the remote log server. –  HopelessN00b Apr 1 '13 at 19:08
1  
@HopelessN00b As I said in my question, optical media isn't going to work for me –  MurrayA Apr 10 '13 at 10:08

Please bear in mind that log files are typically written to and appended, so write-once is not a great option. Put them in a read-only share, or set the permissions so that only the service writing to the logs can edit the folder. This will not protect them from an administrative user, but it will certainly stop 'casual' access to the log files.

share|improve this answer
    
How does write-once not work with logs being appended? What I want is for the logs to be appended to, but not re-written –  MurrayA Apr 1 '13 at 18:19
1  
@MurrayA Just think for a second about how NTFS interacts with files for write operations. Let's say we want to append stuff to a file; this implies that, at a minimum least, the Modified date parameter needs to be changed. How would you do that if the disk is WORM? Create a new file into which you copy the old one plus the new contents? Would you accept to do this every time you want to append data to a file? Anyway, I don't think you can hope to achieve such a thing with NTFS... –  Mihai Todor Apr 3 '13 at 15:40
2  
@MihaiTodor That's not correct. NTFS does not update the Modified date parameter on every write - only when the file is closed after being written to. Logging applications typically keep the current log file open until it is ready to roll to the next log file (because opening and closing on every write would severely impact performance –  MurrayA Apr 4 '13 at 10:28
    
@MurrayA Yes, you're right, but even so, the file will need to be closed eventually, even if you are appending stuff to it, so what I said above still applies, even if it happens once per day. –  Mihai Todor Apr 4 '13 at 15:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.