A storage device contains a smart-card device and a memory device, both connected to a controller. The storage device may be used in the same manner as a conventional smart-card device, or it may be used to store a relatively large amount of data in various partitions. One of these partitions may be a read-only partition that is normally accessible only for read accesses. However, it may sometimes be necessary to update or supplement the data stored in the read-only partition. This is accomplished by a host issuing an appropriate command to the storage device, which may be accompanied by an identifier for an appropriate level of authorization. The controller then changes the attribute of the read-only partition from “read-only” to “read/write” to allow data to be written to the partition. Upon completion, the controller changes the attribute of the partition back to read-only.