10

I recently had reason to move a hard drive from a computer that blew up to another computer for the purpose of recovering data. Under the (unfortunate) circumstances, both the donor and the recipient were Windows XP SP3 machines. I wanted to be sure that the transplanted drive would not be altered by the recipient computer, so I searched like hell but was unable to find a way to mount the transplanted drive as read-only.

How can I mount a hard drive as read-only on Windows XP?

eleven81
  • 417
  • 6
  • 13
  • 29

8 Answers8

13

There is a built-in mehanism to mount a filesystem read-only in Windows, sort of. It's definitely not like a read-only mount on a *nix operating system.

This Superuser.com answer has details. The change you're making using diskpart to toggle a readonly attribute on the volume is making changes to the "read-only" disk. You're modifying the disk to prevent it from being modified. In particular, toggling this bit and forgetting to toggle it back off prevents Windows from booting when you return the disk back to the source system.

This is a suitable technique for troubleshooting but is not a suitable technique for forensic purposes. In that case you really either need to mount it in an operating system that does support read-only mounts, or, best of all, use a hardware-based write-blocker. For serious forensic work you should always use a hardware write-blocker in every step of the process (and you should always be working with images of the original drive after you image and create a signature for the original drive).

As an alternative method, I would consider imaging the source drive with a non-Windows operating system onto a new drive, and working with the new drive in Windows.

N.B. This does not work in XP, since the XP edition of diskpart does no include the "attrib" command that the answer relies on.

Community
  • 1
Evan Anderson
  • 141,881
  • 20
  • 196
  • 331
  • 1
    Evan's answer assumes the drive is non removable. As mentioned in other answers there is a way to just change the registry (and many companies are already doing so with group policy) to force USB drives to be read only. Such a policy/registry would mount the drive as read only if it were mounted after the change is in effect and if the drive was connected by way of USB not eSATA, SATA, or IDE. The first google result for this registry change is http://www.petri.co.il/configure_usb_disks_to_be_read_only_in_xp_sp2.htm and seems accurate enough to recommend. – pplrppl Jan 06 '10 at 20:18
  • 1
    I'm not finding much information about what in the driver stack this registry setting actually tweaks. Assuming that it's sufficiently low in the stack as to truly prevent any writes then it would satisfy the poster's requirement re: "not be altered by the recipient computer". Certainly, USB attachment is going to be slower than (e)SATA or PATA, but it might be worth the trade-off. For any serious forensic work, though, a hardware write-blocker is absolutely a "must". – Evan Anderson Jan 06 '10 at 21:58
  • USB 3 superspeed will make the speed penalty of USB a non issue. It's worth noting that USB enclosures generally don't support SMART data and don't give access to the bare drive in any advanced sense. Not only is it not sufficient for legal forensic work it isn't sufficient for detailed trouble analysis (brand specific diagnostic software won't work over USB). It does however give you a way to access a drive read only on XP without additional hardware or software if your need does not include low level access to the drive. – pplrppl Jan 12 '10 at 22:57
  • The ability to power on the drive separately from the PC can help in "light" recovery situations. Sometimes a drive will only stay working for a few seconds at a time (less than the time it takes to boot windows and copy the files). I've personally recovered data from drives by booting into the OS, letting the startup items settle down, and then turning the external enclosure on. Copy data to the good drive a directory at a time, power down the drive and let it cool off, power it back up and grab another directory, repeat as needed. – pplrppl Jan 12 '10 at 23:02
  • "There is no built-in mehanism to mount a filesystem read-only in Windows." That's rather wrong. See http://superuser.com/a/213015 – Ark-kun Feb 22 '13 at 15:04
  • 1
    @Ark-kun - I agree with your assessment of my statement and I've clarified. – Evan Anderson Feb 23 '13 at 00:59
12

I'm answering quite late, but it might help someone else.

Everett's solution on superuser explains how to modify the volume attributes to make it read-only.

mwfearnley
  • 816
  • 1
  • 11
  • 22
Djof
  • 221
  • 2
  • 4
4

You can use WriteProt, a little command line tool that enables you to write protect a filesystem on Windows.

Doliveras
  • 221
  • 1
  • 6
  • Interesting looking little tool! For casual non-forensic work I'd definitely look into it. For the poster's question, though, I think I'd still recommend imaging and working on an image, since we're talking about potential data loss. Handling the only drive with the data on it should be kept to a minimum. – Evan Anderson Jul 06 '09 at 15:25
2

I've got this bookmarked from a while back, but I've never tried it: http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.windows.file_system&tid=4b1a14f7-6bd2-4c9f-ae64-df57c35712bf&cat=&lang=&cr=&sloc=&p=1

The 4th post (by Edwin) has the solution I am talking about.

MattB
  • 11,194
  • 1
  • 30
  • 36
  • 2
    Whilst this may theoretically answer the question, [it would be preferable](http://meta.stackexchange.com/q/8259) to include the essential parts of the answer here, and provide the link for reference. – Mark Henderson May 06 '12 at 22:53
  • 1
    And now this is a dead link. Because you did not copy in the important info your answer is now useless. – Ariel Jan 09 '13 at 21:51
2

Solution:

From: http://www.autorunremover.com/

"You can set the USB port status to Read only or Readable/Writable with Autorun Virus Remover ..."

Conclusion: if you place your hard drive in an external hard drive case with a USB cable, you can ensure that its mounted as read only.

According to Software Informer there is over 4,078 people with this utility installed on their computer as of 2009-07-07.

Note of caution: when this utility is installed for the very first time it scans external hard drives. Suggest a thorough test flight on another external USB drive before committing your life to it.

Contango
  • 1,150
  • 5
  • 15
  • 31
  • Close but no need to get specific software to do it. Just edit the registry and plug in a USB drive adapter and you are good to go. See http://www.petri.co.il/configure_usb_disks_to_be_read_only_in_xp_sp2.htm for the registry key. – pplrppl Jan 06 '10 at 23:33
1

I have never done this, but once its installed find it under My Computer. Then right-click and select properties then security tab. You maybe able to configure the permissions for what you are looking for.

EDIT - after reading your entire post and EA's answer, the hardware write-blocker sounds best.

note to self - read ENTIRE post before responding and try not to feel like this is a race to beat EA

cop1152
  • 2,656
  • 3
  • 21
  • 32
1

As Evan says there's no easy way of doing this other than to clone the drive. There's a linux live distro called PING that you can use to boot a machine, and it gives you the facility to copy partitions between hard drives (and it's free & pretty easy to use)

Marko Carter
  • 4,092
  • 1
  • 30
  • 38
0

There is a way to access the drive in a mode that is effectively read only.

  1. Mount the drive as per normal.
  2. Right click on the drive, and turn on file sharing.
  3. Alter the permissions for the share to remove "write" permission. Leave "read" permission enabled.

Now, do all of your access through the UNC file share, e.g. \computer\mydrive - RO\

I use this trick to provide an absolute guarantee that my file backup program won't inadvertently stomp on the data that its meant to be backing up.

Contango
  • 1,150
  • 5
  • 15
  • 31