When testing malware I either use a test machine or a VM
My test machine is pretty old and beat up and highly under-powered, more and more malware seems to recognize been in a virtual environment and therefore a VM doesn’t always reflect a “true” test
I’m thinking I might create a small partition on my main HDD and install an OS for purely testing purposes
My question is would this be safe ?
Would I be putting the other partitions at risk via the MBR or some other way ?
Depends on how you go about it. You could be smart and encrypt both partitions with different passwords and NEVER have the other partition mounted at the same time as the other. Also make sure you install the MBR on both partitions as otherwise they share the same MBR.
I was thinking along those lines with the MBR
Strict enforcement of the other steps you mention would also make sense :-TU
I would also isolate the machine on the LAN
So is this enough ?
Does anyone else use this method ?
Well, this is just a THOUGHT. The malware might still be able to mount the other partition (I think, since that is done through Windows) and if that is done then in theory it could try to call the hard-drive directly to write data in the other partition and this could cause a hardware failure since the data would be written randomly over other files.
Now I don’t know if that is how it works, but generally I would not have two operating systems on one hard-drive and feel safe, no matter what security is laying beneath since you are testing. Really I recommend getting a smaller(capacity) hard-drive for testing and then changing the hard-drives. (By changing I mean a) If Desktop, then taking away the SATA cables of the drives not in use. or B) if Laptop then pretty self-explanatory.
I do not know enough to know if this is possible but it does sound feasible.
I have never heard of a partitioned OS for malware testing mentioned before which may mean no one does it as it’s not safe ?
I think your right in recommending a separate dedicated drive
I am still interested to know if this could be safely done.