USB memory stick with automatic encryption

Question

Is there any commercially available USB drive (memory stick) that will automatically encrypt any file(s) copied to the drive, without needing to install or execute special software on the connected computer, except for a possible first-time setup (to choose the password, etc.)?

For example the Datalocker Sentry device supports auto-encryption, but only after executing a program stored on the stick.

I am looking for a device which can be connected to an industrial system with an embedded operating system (Windows CE), and encrypt files transferred to the memory stick through a standard feature of the system, without requiring any modification of the system. The person initiating the transfer should not be able to read/decrypt the files on the USB device.

Edit: I will list below some USB-compatible storage devices featuring encryption that I have found:

• StarTech S2510BU3PW 2.5in USB 3.0 SATA Hard Drive Enclosure with Touchpad AES Encryption. Actually a hard drive enclosure (separate hard drive needed), but could possibly be used in place of a memory stick? From the documentation I couldn't tell if you need to input the password to write to the disk.
• Lok-it secure flash drive: Device must be unlocked with PIN before use. Thus not possible to write to the device without also being able to read from the device.
• Aegis Secure Key and Aegis Padlock: Appears to work the same way as Lok-It. Has read-only mode but not write-only mode.
• Iron Key: Similar to the above. Audit trail generation might be possible using add-on Access Enterprise Server (likely expensive)?
• Gold Key: Similar as above. Drive must be unlocked through an on-screen prompt before use.
• Corsair Flash Padlock: Similar as above.
• Kingston Data Traveller: Similar as above.

Edit 2: A device with the possibility of generating a full audit trail of all file transfers might be an acceptable alternative. For example, the Datalocker Sentry and certain Kingston Data Traveller models seem to be compatible with "SafeConsole" software.

I'm not in charge of or have any direct say over budget, but I imagine I should be able to justify an expense of $500-$1000, if we can avoid more complex data handling procedures/equipment to reduce the risk of data loss or tampering. Alternative solutions or the cost of inadequate data integrity might easily come to more than this sum.

Answer 1

In 2023, there are many hardware encrypted USB sticks or flash drives. As an example there is this

With

• Enterprise-grade security
• XTS-AES 256-bit encryption
• Available in Type-A and Type-C USB
• USB 3.2 Gen 1
• 8GB, 16GB, 32GB, 64GB, 128GB, 256GB
• Up to 250MB/s read, 180MB/s write

It pops up with this

Answer 2

There can't be anything exactly like you're looking for due to the way USB flash storage works. It's just a USB controller chip attached to flash media; you would need an additional encryption chip on the PCB of the device that took everything the controller fed it and encrypted it. It would have to be powered over the USB link and it would also have to provide a way for people to decrypt its contents via some kind of interface no matter what it was plugged into. I suppose in theory it might be done, but the vast majority of use cases would be better served with encryption being performed on the system itself, where it can be faster, innately compatible, and tailored.

It should not be hard to set up software that watches for a USB drive attached to the system to have files added to it, then automatically encrypts that volume. It might be possible to defeat that system by pulling the drive prior to encryption automatically beginning, but that would require some pretty remarkable deftness.

The audit trail idea seems MUCH more viable. A quick review of links on Google leads me to this: https://www.manageengine.com/products/active-directory-audit/removable-storage-auditing.html?ADAPID=1522&kw=%2Busb%20%2Bfile%20%2Blog&adId=27633832007&gclid=CjwKEAjwqpK8BRD7ua-U0orrgkESJADlN3YBY-7r2DY5KPPjSLdJ0zfn52h1m_bm39e2pWdO_WUSDxoCaAvw_wcB

Which appears to be a server-based solution. Obviously file transfers would need to be illegal if the computer were not currently networked or something like that to maintain security.

This is a free, local software doing much the same thing, but of course as such it would be fairly easy to defeat if a knowledgeable adversary were attempting to steal data.

EDIT: looking over your post again, I think the Startech USB HDD with inline AES encryption is extremely close to what you're asking for (and it overcomes all the problems I said devices like this would need to overcome in order to work). I would go with that device. "Access to the encrypted data is allowed through a built-in touchpad" strongly implies write capability is denied until the key is entered.