up vote 8 down vote favorite
share [g+] share [fb]

I recently had reason to move a hard drive from a computer that blew up to another computer for the purpose of recovering data. Under the (unfortunate) circumstances, both the donor and the recipient were Windows XP SP3 machines. I wanted to be sure that the transplanted drive would not be altered by the recipient computer, so I searched like hell but was unable to find a way to mount the transplanted drive as read-only.

How can I mount a hard drive as read-only on Windows XP?

link|improve this question
100% accept rate
feedback

8 Answers

up vote 10 down vote accepted

There is no built-in mehanism to mount a filesystem read-only in Windows. You either need to mount it in an operating system that does support read-only mounts, or use a hardware write-blocker.

As an alternative method, I would consider imaging the source drive with a non-Windows operating system onto a new drive, and working with the new drive in Windows.

For forensic work, though, you really need to be using a hardware write-blocker in every step of the process (and you should always be working with images of the original drive after you image and create a signature for the original drive).

link|improve this answer
1  
Evan's answer assumes the drive is non removable. As mentioned in other answers there is a way to just change the registry (and many companies are already doing so with group policy) to force USB drives to be read only. Such a policy/registry would mount the drive as read only if it were mounted after the change is in effect and if the drive was connected by way of USB not eSATA, SATA, or IDE. The first google result for this registry change is petri.co.il/configure_usb_disks_to_be_read_only_in_xp_sp2.htm and seems accurate enough to recommend. – pplrppl Jan 6 '10 at 20:18
1  
I'm not finding much information about what in the driver stack this registry setting actually tweaks. Assuming that it's sufficiently low in the stack as to truly prevent any writes then it would satisfy the poster's requirement re: "not be altered by the recipient computer". Certainly, USB attachment is going to be slower than (e)SATA or PATA, but it might be worth the trade-off. For any serious forensic work, though, a hardware write-blocker is absolutely a "must". – Evan Anderson Jan 6 '10 at 21:58
USB 3 superspeed will make the speed penalty of USB a non issue. It's worth noting that USB enclosures generally don't support SMART data and don't give access to the bare drive in any advanced sense. Not only is it not sufficient for legal forensic work it isn't sufficient for detailed trouble analysis (brand specific diagnostic software won't work over USB). It does however give you a way to access a drive read only on XP without additional hardware or software if your need does not include low level access to the drive. – pplrppl Jan 12 '10 at 22:57
The ability to power on the drive separately from the PC can help in "light" recovery situations. Sometimes a drive will only stay working for a few seconds at a time (less than the time it takes to boot windows and copy the files). I've personally recovered data from drives by booting into the OS, letting the startup items settle down, and then turning the external enclosure on. Copy data to the good drive a directory at a time, power down the drive and let it cool off, power it back up and grab another directory, repeat as needed. – pplrppl Jan 12 '10 at 23:02
feedback
up vote 8 down vote

I'm answering quite late, but it might help someone else.

Everett has a perfect solution to this on superuser.

link|improve this answer
Late but the best answer so far. – gparent May 6 at 21:41
+1 for linking that solution, I'll remember that. – Chris McKeown May 6 at 22:07
I didn't expect to people to notice this answer right away, if ever. Glad I could help. – Djof May 7 at 3:42
feedback
up vote 4 down vote

You can use WriteProt, a little command line tool that enables you to write protect a filesystem on Windows.

link|improve this answer
Interesting looking little tool! For casual non-forensic work I'd definitely look into it. For the poster's question, though, I think I'd still recommend imaging and working on an image, since we're talking about potential data loss. Handling the only drive with the data on it should be kept to a minimum. – Evan Anderson Jul 6 '09 at 15:25
feedback
up vote 2 down vote

I've got this bookmarked from a while back, but I've never tried it: http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.windows.file_system&tid=4b1a14f7-6bd2-4c9f-ae64-df57c35712bf&cat=&lang=&cr=&sloc=&p=1

The 4th post (by Edwin) has the solution I am talking about.

link|improve this answer
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Mark Henderson♦ May 6 at 22:53
feedback
up vote 2 down vote

Solution:

From: http://www.autorunremover.com/

"You can set the USB port status to Read only or Readable/Writable with Autorun Virus Remover ..."

Conclusion: if you place your hard drive in an external hard drive case with a USB cable, you can ensure that its mounted as read only.

According to Software Informer there is over 4,078 people with this utility installed on their computer as of 2009-07-07.

Note of caution: when this utility is installed for the very first time it scans external hard drives. Suggest a thorough test flight on another external USB drive before committing your life to it.

link|improve this answer
Close but no need to get specific software to do it. Just edit the registry and plug in a USB drive adapter and you are good to go. See petri.co.il/configure_usb_disks_to_be_read_only_in_xp_sp2.htm for the registry key. – pplrppl Jan 6 '10 at 23:33
feedback
up vote 1 down vote

I have never done this, but once its installed find it under My Computer. Then right-click and select properties then security tab. You maybe able to configure the permissions for what you are looking for.

EDIT - after reading your entire post and EA's answer, the hardware write-blocker sounds best.

note to self - read ENTIRE post before responding and try not to feel like this is a race to beat EA

link|improve this answer
1  
Yeah, good luck on the whole "Beating Evan" thing :) – squillman Jul 6 '09 at 15:23
Heh heh... The trick is to get me into a "religious argument" about the intent of some OS feature, etc. That'll slow me down dramatically. – Evan Anderson Jul 6 '09 at 15:26
feedback
up vote 1 down vote

As Evan says there's no easy way of doing this other than to clone the drive. There's a linux live distro called PING that you can use to boot a machine, and it gives you the facility to copy partitions between hard drives (and it's free & pretty easy to use)

link|improve this answer
feedback
up vote 0 down vote

There is a way to access the drive in a mode that is effectively read only.

  1. Mount the drive as per normal.
  2. Right click on the drive, and turn on file sharing.
  3. Alter the permissions for the share to remove "write" permission. Leave "read" permission enabled.

Now, do all of your access through the UNC file share, e.g. \computer\mydrive - RO\

I use this trick to provide an absolute guarantee that my file backup program won't inadvertently stomp on the data that its meant to be backing up.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.