Abstract: A data storage device is disclosed with at least two partitions and a set of switches to separately enable and disable read and write operations to each of the partitions, wherein read and/or write operations for at least one of the partitions is disabled when the data storage device is accessible by one or more potentially malicious processes. In one embodiment, there are five partitions for (1) operating systems and trusted applications, (2) applications from non-trusted sources, (3) confidential data, (4) non-confidential data, and (5) all other data. A mode switch can be used to enable and disable reading and writing for each of the partitions according to a predetermined set of rules that effectively prevent viruses and other malware from altering or accessing programs and data.