NTFS Write-Once Files

Question

for backup purposes I have an external HDD, an I'm on Windows.

What and how should I set (up?) so that files can be written to the drive once but there should be no way they can be deleted or modified? (This is to be a protection against accidental/malicious (=virus) activities. Therefore even admins should be banned from messing with the files once written to the media.) I'm thinking of something like an append-only file system.

Although a set-up-once-and-forget-it scheme would be the best but I'm willing to run a script on each backup operation if that's what it takes.

PS: I have no serious experience with NTFS (not much beyond that of an average user).

Answer 1

There is no such filesystem. Your options are DVD-R or CD-R media or only plug in the HDD when you are backing up. The unplugging option is worse here, the disk is still writable when the disk is plugged in.

Hard disks are read-write medium be definition, and you can't make them write-once media.

Answer 2

In NTFS, WORM behavior is similated using specific ACL entries. For example, you can deny file append by setting the appropriate ACL.

Problem is that any administrators (or use with the required privileges) can simply change the applied ACL and so your read-only file suddenly become writable again.

Unfortunately, a simple USB disk can not work in the way you ask, as a privileged process can do heavy harm to such a disk (for example, it can trigger a USB disk format).

Answer 3

I came here from Google while I was looking for the configuration steps to create a write once read often folder (sometimes also called write once read many). I want to share my solution I had to put together from various other sites.

Let's assume you have the folder Archive on an NTFS-Volume and you want that any content of this folder becomes write once read often. Perform the following steps:

1. Open the Properties of that folder.
2. Navigate to the Security tab.
3. Click on Advanced.
4. Remove the group CREATOR OWNER¹.
5. Remove or modify any other principal according to your needs, to prevent undesired bypass. (In my special case, only SYSTEM and Administrators remain with full access.)
6. Add the user or group that should be allowed to write once and read often.
7. Edit the advanced permissions like shown in the screenshot below:

After that, you can copy and move files and folders to this folder and you can also create files and folders, but you cannot modify exisiting data (no moving, no renaming, no modifying).

---

¹ The CREATOR OWNER group is actually not a group that has any NTFS permissions on files or folders. It is a template. It is used whenever you create a file or a subfolder. Then, your account is added to the ACL of this file or subfolder with the same permissions like the CREATOR OWNER group of the parent directory.

It is removed in this case, so that no account gets an individual entry in the ACL and only the already defined permissions are applied.

Answer 4

Just use Macrium Reflect and image the disk to the HDD. Make it a scheduled differential backup job if you like. Malware won't affect Reflect image files. You can mount the image as a read-only volume to copy from it if you want. For extra safety, unplug the HDD when not backing up.