An apparatus comprising: at least one interface configured to be coupled to a storage device ; and at least one processing device configured to: detect the storage device; and perform a check-in process for the storage device; wherein, to perform the check-in process, the at least one processing device is configured to: scan the storage device to identify any malware contained on the storage device; digitally sign the storage device by storing a hash value on the storage device; digitally sign each of clean files on the storage device by calculating a unique current hash value of each of the clean files; and lock a file system of the storage device by modifying the file system of the storage device, the at least one processing device is configured to modify the file system of the storage device during the check-in process so that (i) one or more protected nodes (102, 102a-102n) within a protected system are able to recognize the modified file system of the storage device and (ii) nodes outside of the protected system cannot recognize the modified file system of the storage device, wherein the modifying the file system includes altering key components of the file system by using an encryption method and a locally stored certificate or private key. at least one interface configured to be coupled to a storage device ; and at least one processing device configured to: detect the storage device; and perform a check-in process for the storage device; detect the storage device; and perform a check-in process for the storage device; wherein, to perform the check-in process, the at least one processing device is configured to: scan the storage device to identify any malware contained on the storage device; digitally sign the storage device by storing a hash value on the storage device; digitally sign each of clean files on the storage device by calculating a unique current hash value of each of the clean files; and lock a file system of the storage device by modifying the file system of the storage device, the at least one processing device is configured to modify the file system of the storage device during the check-in process so that (i) one or more protected nodes (102, 102a-102n) within a protected system are able to recognize the modified file system of the storage device and (ii) nodes outside of the protected system cannot recognize the modified file system of the storage device, scan the storage device to identify any malware contained on the storage device; digitally sign the storage device by storing a hash value on the storage device; digitally sign each of clean files on the storage device by calculating a unique current hash value of each of the clean files; and lock a file system of the storage device by modifying the file system of the storage device, the at least one processing device is configured to modify the file system of the storage device during the check-in process so that (i) one or more protected nodes (102, 102a-102n) within a protected system are able to recognize the modified file system of the storage device and (ii) nodes outside of the protected system cannot recognize the modified file system of the storage device, wherein the modifying the file system includes altering key components of the file system by using an encryption method and a locally stored certificate or private key. <EOS>