windowssecuritydelphiwinapi

How can I make a file trully immutable (non-deletable and read-only)?


I need to make a file truly read only - to keep it as is. No delete, no nothing.

(Setting the 'ReadOnly' attribute isn't an option)

I see now some approaches:

  1. Use a program to keep the file open. Drawback: One can kill the process an then the file closes.

  2. Use a program to set the security attributes. Drawback: The file can be deleted. Also, the attributes can be changed back.

Any ideas? Also, a sample code (preferably in Delphi) would be appreciated.

UPDATE: Thanks to all answers so far. They are really great. I realize that I wasn't very clear. The problem which we want to solve is this:

There are some .txt-like files which contains sensitive information. Our clients wants to be sure that these files aren't changed 'behind the scenes' on their computers. We should mention that their PCs can be infected easily with malware specifically targeted to do this thing. Our clients should be able to open these files with Notepad, Wordpad etc. but they accept that the files are Read Only. If any of our clients take a decisive action like entering in 'Safe Mode' etc. and tampering the files from there is their responsibility. We should guard them from any malware, including a zero-day attack. (Hence a classical Antivirus solution isn't so appropriate).

Can you give now some ideas?

PS: My most sincere apologies once again for not being so clear from the beginning.


Solution

  • A way be to sure that these files aren't changed 'behind the scenes' would be to add a signature to the file.

    To sign the file you could for example: Make a string with the whole content of the file + a secret password and calculate an SHA1-Hash of the string. Then add this hash on the first or last line of the file.

    To check the signature: Read the file, remove the line with the hash, add the secret password, recalculte the hash and check if it is the same as the one in the file.

    To calculate SHA-1-Hashes with Delphi you can for example use MessageDigests.