10

I recently had reason to move a hard drive from a computer that blew up to another computer for the purpose of recovering data. Under the (unfortunate) circumstances, both the donor and the recipient were Windows XP SP3 machines. I wanted to be sure that the transplanted drive would not be altered by the recipient computer, so I searched like hell but was unable to find a way to mount the transplanted drive as read-only.

How can I mount a hard drive as read-only on Windows XP?

8 Answers 8

13

There is a built-in mehanism to mount a filesystem read-only in Windows, sort of. It's definitely not like a read-only mount on a *nix operating system.

This Superuser.com answer has details. The change you're making using diskpart to toggle a readonly attribute on the volume is making changes to the "read-only" disk. You're modifying the disk to prevent it from being modified. In particular, toggling this bit and forgetting to toggle it back off prevents Windows from booting when you return the disk back to the source system.

This is a suitable technique for troubleshooting but is not a suitable technique for forensic purposes. In that case you really either need to mount it in an operating system that does support read-only mounts, or, best of all, use a hardware-based write-blocker. For serious forensic work you should always use a hardware write-blocker in every step of the process (and you should always be working with images of the original drive after you image and create a signature for the original drive).

As an alternative method, I would consider imaging the source drive with a non-Windows operating system onto a new drive, and working with the new drive in Windows.

N.B. This does not work in XP, since the XP edition of diskpart does no include the "attrib" command that the answer relies on.

6
  • 1
    Evan's answer assumes the drive is non removable. As mentioned in other answers there is a way to just change the registry (and many companies are already doing so with group policy) to force USB drives to be read only. Such a policy/registry would mount the drive as read only if it were mounted after the change is in effect and if the drive was connected by way of USB not eSATA, SATA, or IDE. The first google result for this registry change is petri.co.il/configure_usb_disks_to_be_read_only_in_xp_sp2.htm and seems accurate enough to recommend.
    – pplrppl
    Jan 6, 2010 at 20:18
  • 1
    I'm not finding much information about what in the driver stack this registry setting actually tweaks. Assuming that it's sufficiently low in the stack as to truly prevent any writes then it would satisfy the poster's requirement re: "not be altered by the recipient computer". Certainly, USB attachment is going to be slower than (e)SATA or PATA, but it might be worth the trade-off. For any serious forensic work, though, a hardware write-blocker is absolutely a "must". Jan 6, 2010 at 21:58
  • USB 3 superspeed will make the speed penalty of USB a non issue. It's worth noting that USB enclosures generally don't support SMART data and don't give access to the bare drive in any advanced sense. Not only is it not sufficient for legal forensic work it isn't sufficient for detailed trouble analysis (brand specific diagnostic software won't work over USB). It does however give you a way to access a drive read only on XP without additional hardware or software if your need does not include low level access to the drive.
    – pplrppl
    Jan 12, 2010 at 22:57
  • The ability to power on the drive separately from the PC can help in "light" recovery situations. Sometimes a drive will only stay working for a few seconds at a time (less than the time it takes to boot windows and copy the files). I've personally recovered data from drives by booting into the OS, letting the startup items settle down, and then turning the external enclosure on. Copy data to the good drive a directory at a time, power down the drive and let it cool off, power it back up and grab another directory, repeat as needed.
    – pplrppl
    Jan 12, 2010 at 23:02
  • 1
    @Ark-kun - I agree with your assessment of my statement and I've clarified. Feb 23, 2013 at 0:59
12

I'm answering quite late, but it might help someone else.

Everett's solution on superuser explains how to modify the volume attributes to make it read-only.

3
  • Late but the best answer so far.
    – gparent
    May 6, 2012 at 21:41
  • +1 for linking that solution, I'll remember that. May 6, 2012 at 22:07
  • I didn't expect to people to notice this answer right away, if ever. Glad I could help.
    – Djof
    May 7, 2012 at 3:42
4

You can use WriteProt, a little command line tool that enables you to write protect a filesystem on Windows.

1
  • Interesting looking little tool! For casual non-forensic work I'd definitely look into it. For the poster's question, though, I think I'd still recommend imaging and working on an image, since we're talking about potential data loss. Handling the only drive with the data on it should be kept to a minimum. Jul 6, 2009 at 15:25
2

I've got this bookmarked from a while back, but I've never tried it: http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.windows.file_system&tid=4b1a14f7-6bd2-4c9f-ae64-df57c35712bf&cat=&lang=&cr=&sloc=&p=1

The 4th post (by Edwin) has the solution I am talking about.

2
  • 2
    Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. May 6, 2012 at 22:53
  • 1
    And now this is a dead link. Because you did not copy in the important info your answer is now useless.
    – Ariel
    Jan 9, 2013 at 21:51
2

Solution:

From: http://www.autorunremover.com/

"You can set the USB port status to Read only or Readable/Writable with Autorun Virus Remover ..."

Conclusion: if you place your hard drive in an external hard drive case with a USB cable, you can ensure that its mounted as read only.

According to Software Informer there is over 4,078 people with this utility installed on their computer as of 2009-07-07.

Note of caution: when this utility is installed for the very first time it scans external hard drives. Suggest a thorough test flight on another external USB drive before committing your life to it.

1
1

I have never done this, but once its installed find it under My Computer. Then right-click and select properties then security tab. You maybe able to configure the permissions for what you are looking for.

EDIT - after reading your entire post and EA's answer, the hardware write-blocker sounds best.

note to self - read ENTIRE post before responding and try not to feel like this is a race to beat EA

2
  • 1
    Yeah, good luck on the whole "Beating Evan" thing :)
    – squillman
    Jul 6, 2009 at 15:23
  • Heh heh... The trick is to get me into a "religious argument" about the intent of some OS feature, etc. That'll slow me down dramatically. Jul 6, 2009 at 15:26
1

As Evan says there's no easy way of doing this other than to clone the drive. There's a linux live distro called PING that you can use to boot a machine, and it gives you the facility to copy partitions between hard drives (and it's free & pretty easy to use)

0

There is a way to access the drive in a mode that is effectively read only.

  1. Mount the drive as per normal.
  2. Right click on the drive, and turn on file sharing.
  3. Alter the permissions for the share to remove "write" permission. Leave "read" permission enabled.

Now, do all of your access through the UNC file share, e.g. \computer\mydrive - RO\

I use this trick to provide an absolute guarantee that my file backup program won't inadvertently stomp on the data that its meant to be backing up.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .