You sometimes may want to prevent that other people connect USB devices to your PC, for instance to avoid that they download data from the PC to external drives. Or, you might want to prevent users from using the connected USB printer whenever you are not on your computer.

While you could do that with Registry hacks and other means, it is usually a lot easier to use a program like USB Manager for that job. Keep in mind that disabling USB devices or device types is not a 100% protection against data theft, copying or printing of data.

USB Manager displays the four USB device types that it supports in its interface on program start. All four of them, that is storage devices, usb printers, USB audio devices and USB scanners, are enabled by default indicated by the green checkmark next to each symbol.

You can disable a specific device type, e.g. printers, with a click on the device icon in the program interface. You can alternatively use the program’s system tray icon to enable or disable device types.

All it takes is a few clicks to disable or enable USB devices on the system. It is furthermore possible to set a program access password in the options to avoid that others enable devices again that you have disabled.

The options are also the place to configure hotkeys, hide the system tray icon or configure the application to autostart with the Windows operating system.

USB Manager serves a specific purpose. Depending on the USB devices, you may notice that some are not disabled even though they should be. This was for instance the case with my Logitech G930 wireless headset which was not disabled when I disabled USB Audio using the software.

Windows users who would like to give it a try can download the software from the developer website. A commercial server client is available that can be used to control USB devices on remote computer systems.

Please note that the program offers to install an optional software package during installation. Make sure you click cancel here if you do not want to install several unrelated programs that may also make changes to your browser’s default search engine and homepage.

Update: The audio headset has been disabled correctly after a reboot. Please also note that you need to run the program with elevated rights.

Update 2: The Makesoft website is returning a 404 not found error currently.It is not clear if technical difficulties are responsible, or if it has been abandoned. We have uploaded the latest version of USB Manager to our servers. Click on the following link to download it: USB Manager (3)

It could become a problem if a USB hub is connected to the port that is powering multiple devices as it could mean that this exceeds the maximum power that can be supplied by the port. This could result in connection problems and even data loss.

A good start is to find out how much power the USB devices need before connecting them together to an USB hub. The free portable software USBDeview by Nirsoft can do that. Just download the software, unpack it and start it on the target computer system.

Power is one of the information provided by the application. You need to scroll a bit until you find the column as it is located near the end.

You need to click on the Power column title to sort the devices. Not every device requires power and this brings those that do to the top of the list. It is not always that easy to identify devices. The description and drive letter usually help out here. You can also try and disconnect devices and refresh the listing to identify it by looking at which device is missing from the listing after the disconnection.

Did you ever run into troubles running multiple USB devices on one USB port?

But USB devices introduce several security risks that computer users did not have to cope with since the demise of the floppy disk. Programs like USB Dumper can for instance copy all contents of a connected USB-stick directly to the host computer’s storage devices without the USB-stick owner ever knowing that this happened.

But losing confidential data is not the only risk. USB devices can also be targeted by malicious software which use the USB-stick as a host to infect other computer systems it gets connected to.

This article takes a look at some of the options that USB-stick owners have to protect their sticks from those dangers.

Protecting the data on the stick

Data on USB devices can be read by any computer user on any system by default. The data is not protected and all it takes is to connect the stick to access the data on it. This alone can be a problem if the stick is lost or stolen.

The only reasonable option is to protect the confidential data on the stick by encrypting it. We have seen other tips in the past that suggested to use the NTFS file system to protect the data from third parties. That tip might work if the third party is using a Windows NT based system, it fails if they are not.

Encryption software like True-Crypt, USB Safeguard, Bitlocker or AxCrypt can be used to protect the data on the stick. It is often not necessary to encrypt the whole stick. True-Crypt can for instance be used to encrypt part of the space on an USB-stick. It creates an encrypted container on the disk. Data stored in that container becomes only accessible if the right master password is provided.

The disadvantage of True-Crypt is that the encryption software is needed to decrypt the container. AxCrypt on the other hand creates self-extracting encrypted files. This is handy for single files that need to be protected but not a viable option if dozens or hundreds of files need to be protected.

True-Crypt can be installed in traveler mode on the USB stick. Admin rights are still needed to execute the program on other systems though.

All reviewed options until now have been software based. An alternative to that are secure USB devices that use build-in security to protect the stick and data.

All popular manufacturers from Kingston to Corsair offer secure USB devices. The multitude of different security mechanisms and options makes the field quite hard to overlook.

Devices differ in encryption algorithms used, their encryption strength and handling. Some require hardware based authentication on keypads while others are software based solutions that might not be compatible with all operating systems.

Ironkey is a notable exception as it is compatible with Windows, Linux and Mac operating systems. Encryption and decryption is hardware based. The price is however on the upper end of the pricing scale for secure storage devices. The IronKey personal and basic sticks for instance retail for $79 with 1 Gigabyte of storage. Corsair’s Padlock offers 8 Gigabytes for $55.

Both hardware and software based solutions to secure an USB-stick have their advantages and disadvantages. Software based security comes with no additional costs while hardware based devices are packed with additional features that might or might not be needed by the user.

Hardware based solutions are not necessarily more secure than their software counterparts though. It has happened in the past that manufacturers had to recall their products after a flaw had been detected that could be exploited to gain access to the data on the devices.

Securing data with any of the above solutions ensures that data cannot fall into the wrong hands if the device is stolen or if its lost.

Misc Helpful Programs

Another problem that users face from time to time is to forget to disconnect their USB stick from a computer. The data might be protected with encryption but losing the stick might still mean that a day’s work is lost as well.

USB Stick Watcher is a small background application for Windows that will notify the user in regular intervals that the USB stick is still plugged into the computer. It will furthermore display the notifications on shutdown or logoff.

usb stick watcher

USB Stick Watcher is a useful utility for people, who transfer their data (documents, music and more) across different computers. This will display recurring reminder if your pen drive is still plugged in PC. Also, USB Stick Watcher will show warning message every time when you try to turn PC off, or log off without unplugging your pen drive. USB Stick Watcher will ensure that you never leave your USB Stick plugged in to a computer!

An alternative to this software based solution is to put the usb stick on the same keychain as the car / home keys. People will usually pay more attention to their keys than the USB stick they are working with.

USB Write Protector is another interesting free software program. The write protection of USB devices can be enabled with this software. It only works on Windows PCs but is a small portable program that fits perfectly on USB devices of any site.

usb write protection

Thumbscrew is an alternative to USB Write Protector. It provides access to the same functionality.

Thumbscrew has a few limitations:

1. I can’t guarantee it’s 100% forensically sound. Buy a proven USB hardware write blocker if you want to be sure.

2. USB mass storage devices that are already mounted as writeable will stay writeable until they are removed and reinserted. The same applies if you turn off read only protection while a USB mass storage device is active, it will become writable and stay that way until removed and reinserted.

USB devices with hardware write protection switches add an extra layer of security. All software based solutions need to be executed on the host system before they become active which is a problem if malicious software is already active on the host system. Hardware based write protection ensures that no data is written on the USB stick for as long as the protection is in place. Putting an antivirus solution on the USB stick could for instance be used to scan the host system to ensure it is clean before disabling the write protection on the USB stick.

Are you using USB sticks regularly? Let us know how you protect your sticks in the comments.

USB Agent is a portable software program that provides this functionality. It requires some manual preparation before it will execute the programs. This should not take longer than a few minutes the most though. The most important step in the process is the creation of a new file on the USB device that has to be named usbagent.inf. The following information need to be added to the file after its creation (with a text editor):

[usbagent]
ON=start-app.exe
OFF=stop-app.exe

where start-app.exe and stop-app.exe need to be replaced with executables or batch files that the user wants to execute if the USB device is connected and disconnected. The executables and batch files can be stored on the USB device by using the format

ON=%basepath%\start-app.exe

where %basepath%\ is pointing to the root folder of the USB device.

USB Agent comes with an option to mount True Crypt containers that are stored on USB devices. This can be a handy option to automate the mounting of the encrypted container. The portable software is available at the developer’s German website. A link to Google Translate is listed at the top of the page to translate the page into a different language. The program itself is available in English and German and compatible with Windows 2000 and newer Microsoft operating system including Windows 7 and Windows Server 2008.

The Windows operating system has a Registry setting that can add USB write protection to a computer system. It is like a switch that can be enabled to make use of the write protection or disabled to allow write processes.

Users who experience problems writing to USB devices might want to take a look at this setting as well if they have the proper rights to do so to see if it is the cause for their difficulties.

Start by opening the run dialog box with the keyboard shortcut [Windows R]. Type [regedit] and hit [enter]. This should open the Windows Registry editor.

Navigate to the following Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\

Look at the sub-keys and see if a key named StorageDevicePolicies is listed. If it is skip this paragraph and read the next. If it is not create the key by right-clicking Control and selecting New > Key

See if there is an entry named WriteProtect. It can be easily created if it is not present by right-clicking in the right window and selecting New > DWord from the menu. The following values are allowed for this entry:

• 0 – This will allow write processes on USB Flash Drives
• 1- This will block write processes on USB Flash Drives.

An alternative would be to delete the Registry key WriteProtect completely to enable both read and write processes. A restart or log off is required before the changes take effect.

USB Blocker (via Techie Buzz) is a software program that can protect USB ports from being accessed unauthorized. One main benefit of USB Blocker is that it relies solely on group policy mechanisms and does not have to be deployed on client computer systems. USB port protection can be achieved with just a few mouse clicks on connected computer systems.

The application is controlled via a small interface that pops up for the first time after installation. A click on the Block USB Devices checkbox enables the options for managed active directory domains and provides the means to exclude computers from being blocked by the USB port protection software. There is also an option to only block devices for specific organizational units in the Active directory.

The usb port protection software can only be downloaded after a quick registration (without verification) at the website of the developer. USB Blocker is compatible with most Microsoft operating systems. A commercial version exists as well which extends the functionality of the USB port protection to include additional devices among other things.

USB Safely Remove is a USB device manager that can be run on 32-bit and 64-bit editions of Windows 2000, Windows XP and Windows Vista. USB devices like removable hard drives, memory sticks or even connected digital cameras become increasingly common but Microsoft failed to add the means to manage the devices effectively. The software program works basically with any hot-plug devices like USB, SATA, Firewire or PCMCIA devices.

One of the problems that Windows users might encounter is that most devices that get connected to the computer will use the name USB mass storage device. That makes it difficulty to safely unplug a specific device from the computer system. There is also no option to hide important devices that (never) get disconnected from the system.

USB Safely Remove provides an easier way to manage the devices in Windows. It uses and displays the actual device names & icons and offers ways to rename devices, change device icons and hide devices from the removal menu. A single hotkey can be used to navigate the menu and safely remove or open the device.

This is however just one function of the software. Another annoying Windows feature is that every card reader slot will be assigned to a drive letter which can easily mean that four or even more device letters are taken by card reader slots that are rarely if any in use. USB Safely Remove can be used to hide empty card reader slots automatically. There is also the option to eject cards directly from a card reader. Any process that would lock the card would be displayed so that it could be taken care of.

The reason if a device cannot be stopped on the computer system will be displayed by USB Safely Remove. It will display the running processes that lock the device so that it cannot be stopped or disabled.

It is probably a good time to explain the differences between stopping and disabling a device. Some devices cannot be stopped but only disabled in the hardware manager. USB Safely Remove automatically detects the type of drive and will stop or disable the device without making the user think about the type of device. It can also enable a disabled device at the next start of the computer system.

Programs can be started after a device gets connected to the computer and before a device gets disconnected or stopped again. One possible use for that feature would be to run the encryption software True Crypt to mount and dismount the encrypted container.

A command line version of the software program is provided as well which can be integrated in batch scripts or simply run from the command line.

One of the most interesting features of USB Safely Remove is the ability to start a stopped device. Without the software one would have to unplug the cable of the device and plug it back in so that Windows recognized it again. With USB Safely Remove it is just a matter of selecting the feature in the right-click menu of the application.

The USB software manager comes with several additional features like the ability to mount storage devices as NTFS folders, managing of drive letters or preventing Windows from assigning specific drive letters to devices.

The software developer created a unique url which can be used to request a serial number for the software program. This url is good for today only which is why we decided to publish the Giveaway right now and not at the usual time.

The main interface consists of three buttons for the restore, backup and rescan functions. The rescan button is helpful if an USB device is not automatically recognized by the application which is the case when a card is changed in a card reader.

The data of the USB device is stored in a compressed format on the hard disk of the computer from where it can be burned to disk for safekeeping. The software does not only come with an option to backup USB devices to create USB images but also to restore them. It would be possible to backup the data of your iPod and later restore that image again. I’m not sure but it could work to replicate the data on another device of the same kind.

The USB Image Tool requires the Microsoft .net framework 2.0 and a computer running Windows XP or Windows Vista. It ships with a dll called usbit32.dll that has to be in the same folder as the application, which it is by default.

A rule of thumb would be to always unplug the device safely if you want o minimize the chance for data corruption. The Microsoft solution for disconnecting USB devices is not optimal and is different (of course) depending on your operating systems. One of the most nerve wreaking messages is “It is now safe to remove this device” which can’t be turned off as far as I know.

If a process has locked files on the device the user will receive the message “This device cannot be safely stopped” without telling him (of course) which process is responsible for the locked files.

The software USB Disk Ejector is one solution to some of the difficulties that users face. It get rids of the message that the device can be safely removed and it can also close processes that are locking files on the device so that it can be removed.

One thing I like is that you get a gui and a command line version. The command line version for instance could be used to create a shortcut to eject a drive by name, letter, program running and partial name. The gui is helpful for users who prefer to work with graphical user interfaces. It displays a list of all connected USB devices and will automatically refresh the window if a new device is connected to the computer. A double-click removes the USB devices from the computer.

This is where Dante stepped in and wrote an explanation on how to assign a specific drive letter to the USB drive.  He also mentioned that the tool would not work in Windows Vista and that the method using Disk Management would.

Right-click on the My Computer icon in Windows XP or on Computer in Windows Vista and select Manage form the menu. You can alternatively access it by entering compmgmt.msc in the run box or search box. Now select Disk Management in that menu and perform a right-click on the drive that you want to assign a specific driver letter to.

Now select Change Driver Letter and Path and assign the specific drive letter to the device.

A far superior solution is to use a software called USB Drive Letter Manager which is highly configurable automatically solving possible conflicts between USB devices and network drives. The reason for such a conflict is that Windows XP assigns the first available drive letter to a device that gets connected without checking first if there is a network share on that drive letter.

USB Drive Letter Manager runs as a service in Windows and loads the configuration every time a device is connected to Windows. You would therefor first download and unzip the software to a location on your hard drive and install the service using the _install.cmd file.

Once the service is running you can stop, start and uninstall it using the files located in the same directory. Edit the file USBDLM_sample.ini afterwards which is the configuration file for the USB Drive Letter Manager. Once you are done editing it you remove the _sample part of the filename and save it into the same directory.

There are lots of ways to configure this file and I would like to show only a few possible scenarios. The excellent help file, available in English and German, explains everything in details.

One possibility would be to assign a range of drive letters to USB devices and / or exclude drive letters who will never be assigned to those devices.

[DriveLetters]
Letter1=X
Letter2=Y
Letter3=Z

The option above would assign the letters X,Y and Z to USB devices that are connected to the computer.

[ExcludedLetters]
Letter1= E
Letter2= F
Letter3= G

This would exclude drive letters E,F and G from being assigned to USB Devices. You can naturally increase both by adding more lines like Letter4= and so on.

While this is already helpful it does not assign a drive letter permanently to a specific USB device. To do that you have to tweak the configuration further.

One possibility would be to assign a drive letter to an USB device of a specific size.

;USB drives above 20GB at U:
[DriveLetters10]
MinDiskSize=20GB
Letter1=U

This would assign the drive letter U to an USB device with at least 20 Gigabytes of storage. Please note that the first line is simply a comment and the second line has to use a unique number between 1 and 99 plus one without a number.

The software checks if each DriveLetters configuration is true or false and will use the first true one.

The best solution to assign a specific USB device to a drive letter would be to use the devices serial number in the configuration. To find out about the serial number you use the script ListUsbDrives_To_Notepad.cmd which is located in the root directory of the application as well.

The script will create a new text file listing all of your devices including your hard drives. Browse to the USB drive and look for the lines Ctrl DevID= or Friendly Name=. You can use both to assign a drive letter to that USB device. This would look like the following:

;USB device:
[DriveLetters10]
DeviceID1=1234567890ABCD
Letter1=V

I don’t want to detail more of the options but just name a few that could be useful. It is as well possible to assign drive letters by USB port, Volume Label, drive type, device type, bus type, partition number, existance of a file and letters by active user.

I have not encountered a problem working with USB Drive Letter Manager yet and was able to assign specific drive letters to all of my USB devices. I can help if you encounter problems or have difficulties writing the configuration, just drop me a line in that case then.

Read More:

USB Drive Letter Manager

So, open the Device Manger by either typing device in the search box of Windows Vista or typing devmgmt.msc from the command line. Go to the disk Drives tab and right-click the SATA drive and select Properties from the menu. Now select the Policies tab and check the box Enable Advanced Performance. You have to repeat the process if you have more than one SATA drive installed on your system

You have to perform almost the same steps to speed up usb drivers under Windows Vista. Open again the policies tab of the USB drive and select Optimize for Performance from the options there. This method has one little drawback, you need to Safely Remove the Hardware if you want to unplug the device from your system.

Both tips have been found at the How to Geek.

It is important to check if a unauthorized USB device has been connected to a computer. This could be a clear sign of a security breach, maybe data theft. One could argue that the damage has already been done but would you prefer to know of it at all or be totally unprepared for future events that result from this ? It is probably not that important for non business users but it could still be nice to know if someone else connected a device to your computer while you were away.

USB Deview lists the name of the device, a description and device type, a serial number and a created date. You do get a pretty good impression which kind of device has been connected. I checked my computer and was able to spot the Sony Ericsson W810 mobile phone from a friend that was once connected to my computer.

You can use USB Deview to uninstall previously connected USB devices or disconnect currently connected ones. Great little application, does not need to be installed at all and uses just 38K unpacked.