Windows 10只读备份创建及数字签名添加技术咨询

Hey there! Since you're new to Windows and only have an hour to get this done, let's break this down into straightforward, time-efficient steps that fit your constraints.

一、关于EaseUS的确认 #

First off, yes—EaseUS Todo Backup does support creating read-only backups. Both its free and paid versions let you lock backups to prevent modifications, either via built-in protection features or by adjusting Windows file permissions after the backup finishes. It’s pretty user-friendly, which is ideal for your first Windows task.

二、快速创建只读备份（两种方案，适配1小时时间窗） #

方案1：EaseUS Todo Backup（新手友好） #

If you’ve pre-downloaded the installer to a USB (to save on-site download time):

• Launch the software, select System Backup (this covers your entire Windows system, which is likely what you need).
• Pick an external drive as the backup destination (double-check it has enough space first).
• Start the backup—it typically takes 15-30 minutes depending on your system’s size.
• Once done:
  1. Locate the backup file/folder on your external drive.
  2. Right-click → Properties → Security tab → Edit.
  3. For all user groups, uncheck the Write permission, then apply changes.
  4. Alternatively, use EaseUS’s built-in "Protect Backup" feature (found in the backup list) to set a lock and mark it as read-only in one click.

方案2：Windows自带备份工具（零额外软件，省时间） #

Skip installing third-party tools entirely with Windows’ built-in utility:

• Press Win + S, search for Backup and Restore (Windows 7) (it works perfectly on Windows 10, don’t worry about the name).
• Click Create a system image, select your external drive as the target.
• Let the backup run—again, 15-30 minutes for most systems.
• Post-backup:
  1. Navigate to the folder containing the system image.
  2. Right-click → Properties → Check the Read-only box → Click Apply → Choose "Apply changes to this folder, subfolders and files" in the pop-up.

三、添加防篡改验证（数字签名/哈希校验） #

Since you need to detect any modifications, here are two practical options tailored to your time limit:

方法1：PowerShell哈希校验（最快，无需额外工具） #

This is perfect for your 1-hour window—it generates a unique "fingerprint" for your backup that will break if the file is altered:

1. Press Win + X, select Windows PowerShell (Admin).
2. Navigate to your backup’s location with the command:

   cd D:\YourBackupFolder
   

3. Run this to generate a SHA256 hash (the most secure common algorithm):

   Get-FileHash -Path "your-backup-file-name" -Algorithm SHA256 | Out-File "backup-verification-hash.txt"
   

4. Save the backup-verification-hash.txt file separately (e.g., on a different USB or your email). Later, to check if the backup was modified, re-run the hash command and compare the output to the saved file—any mismatch means the backup was altered.

方法2：正式数字签名（仅如果你需要 formal 签名） #

If you want a proper digital signature (not just hash), you’ll need a code-signing certificate, but this might eat into your 1-hour window. If you still want to try:

• Use Windows’ built-in signtool (part of the Windows SDK—you’ll need to install the minimal SDK on-site, which takes ~10 minutes).
• Run the command:

  signtool sign /f your-certificate.pfx /p your-password "your-backup-file"
  

But note: This is overkill for a quick backup—stick with the hash method if time is tight.

四、Time-Saving Tips for Your 1-Hour Window #

• Prep an external drive beforehand: Format it to NTFS (Windows’ preferred format) and make sure it has at least 2x your system’s used storage space.
• If using EaseUS, download the installer to a USB drive before arriving—don’t waste time downloading on-site.
• Follow the order: Backup first → Set read-only → Generate hash. Modifying permissions mid-backup can cause errors.

备注：内容来源于stack exchange，提问作者regina_fallangi