2

I would like to install a second hard drive on my laptop and use it as something like a sandbox, just for games and home, and the other for work and sensitive data only. Both hard drives have windows installed on them.

What I need is a way to completely isolate them from each other so there is no way for a malware to spread from to the other: virtually unplug the hdd I'm not using, if you will.

To be even more clear, suppose I'm intentionally gonna infect one HDD with the nastiest of the malwares, I need to make sure that it is impossible for it to spread to my other drive.

Is there a way I can achieve this without having to physically remove the HDD I'm not going to use?

Improve this question
1
  • You're still sharing hardware so "completely" isolated from the "nastiest" malware isn't feasible. Granted, this level of sophistication is well funded nation states. That being said, you can only achieve acceptable levels of risk. Commented Mar 20, 2021 at 18:59

5 Answers 5

Reset to default
3

If you used whole-disk encryption on one (think BitLocker), then you can isolate one from the other. Leave the sandbox drive unencrypted and your production drive encrypted. Setup your boot manager to choose between the two and when booting up the production drive, you supply the decryption key (USB dongle).

This would protect your production drive (in more ways than one) and prevent the sandbox drive from doing anything to the production drive, including deleting anything.

Another thought is to use a file system that the other OS cannot read. If you are using Linux you might be able to simply not include the drivers for the file systems used on the other drives (requires knowledge of how to compile a custom kernel).

Improve this answer
8
  • Would this encryption ensure that no writing could be done to drive, 100%? Commented May 5, 2014 at 21:35
  • @user1836773 If the decrypt key was not supplied, then yes, 100%. Commented May 5, 2014 at 22:54
  • 3
    @user1836773 No, it will not. It will prevent meaningful writing to the hard drive because any attempt to write will simply corrupt the data, but total protection can only be obtained by unplugging the drive. Commented May 7, 2014 at 4:40
  • But will it protect against infection, Mark? Commented May 7, 2014 at 15:50
  • 2
    @schroeder You can't use traditional file I/O functions, but you can use the same raw disk I/O functions that the operating system uses. You may need OS-level permissions to do this, but this won't be a problem for malware. Commented May 7, 2014 at 19:30
2

There are devices with a physical switch between two HDDs.

There is no way to virtually isolate the drives. If you used encryption on both drives, it would make it very hard to access data on the second drive from your sandbox, but it would still be very easy to delete it.

So the best way would be to use a physical switch between your two drives.

Improve this answer
5
  • 1
    That's cool! Not practical for a laptop tho. Commented May 5, 2014 at 11:07
  • 1
    Ahah, yes, I didn't see that coming... Commented May 5, 2014 at 11:27
  • Just found an article saying "BitLocker does not protect the computers contents while Windows is running. Again, BitLocker is built for offline attacks[...]" Commented May 6, 2014 at 8:48
  • Of course it doesn't... But I don't see why it's related to what I said. When I was talking about encryption (and not only BitLocker), I wanted to say that if drive A is encrypted and system is running on drive B, B has no way to read data on drive A if B doesn't have the key. (Though B can delete data on A). Commented May 6, 2014 at 9:03
  • Yeah, I thought the same. I was just wondering if that's how it would actually work. I just took a quick look at my bios and there are many security options there too, I will check them later. Commented May 6, 2014 at 9:18
1

You can't. See my answer to the similar question How isolated are 2 operating systems on 1 harddisk?

The nastiest of the malwares you installed in disk B could easily wipe the contents of disk A.

You would want to use a virtualization solution (QEmu, VMware, VirtualBox, VirtualPC…). In this way, the guest operating system doesn't have full control over the hardware, and won't be able to escape to the host OS. The disk used for that install can be physical or virtual.

As a different solution, have you considered, as an alternative to opening the laptop and unplugging the disk, to install a (hardware) switch to drive the current to one hard disk or the other?

Improve this answer
0

Is it possible to do something like this in the BIOS? So when you boot up, you open the BIOS menu, switch to setting A with disk A, ignoring disk B. Then you reboot, open BIOS, switch to setting B with disk B, which ignores disk A.

Just a suggestion - I don't know if this is possible. Maybe with UEFI?

Manually disabling a disk is an option!

Improve this answer
1
  • Not really. You could disable BIOS detection at startup (just change the boot order, usually), but the OS will perform and rely on its own detection. The BIOS doesn't mediate accesses to the HDD, the OS directly sends the commands to the SATA bus. Commented Sep 18, 2015 at 22:09
0

I have a laptop with internal SSD (for work) and second HDD in system bay (DVD bay) for home. SSD with Win 7 and HDD with Win 8.1.
I used windows boot choice.

Last week I swapped Win 8.1 to Win 10. Two days, everything was ok. Then Win 10 showed blue screen after booting with error 00021a. Nothing worked, but I saw data when I connect the HDD as an external drive.

Then I bought SSD instead of HDD (it was very old). I installed Win 8 on it. Win 7 SSD was not in computer during installation. Then I put Win 7 SSD in and tried to boot. PC wanted to run chkdsk on both drives. I didn´t prevent chkdsk running.
One disk was checked in the moment and the second lasted 15 minutes, and it did something on it. After that it was not possible to boot Win 7 at all. It was falling to rebooting again and again.

Then I handed it over to our IT man and he ended the work of destruction. He slipped up the drive number and accidentally erased boot directory of Win 7 SSD. Then after booting the FAT changed to FAT16.

So now I recommend not to use any SW choice of OS. Only on the BIOS level. And to your question: I am not very skilled in PCs but you can activate or deactivate specific SATA in BIOS. I think it prevents approaching the disk at all, doesn´t it?

Improve this answer
1
  • 1
    Your key point "deactivate specific SATA in BIOS" is good, but it's a little lost in your story. Suggest you edit to make it more prominent. Commented Sep 18, 2015 at 13:19

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.