I recently had reason to move a hard drive from a computer that blew up to another computer for the purpose of recovering data. Under the (unfortunate) circumstances, both the donor and the recipient were Windows XP SP3 machines. I wanted to be sure that the transplanted drive would not be altered by the recipient computer, so I searched like hell but was unable to find a way to mount the transplanted drive as read-only.
How can I mount a hard drive as read-only on Windows XP?
There is a built-in mehanism to mount a filesystem read-only in Windows, sort of. It's definitely not like a read-only mount on a *nix operating system.
This Superuser.com answer has details. The change you're making using
diskpart
to toggle areadonly
attribute on the volume is making changes to the "read-only" disk. You're modifying the disk to prevent it from being modified. In particular, toggling this bit and forgetting to toggle it back off prevents Windows from booting when you return the disk back to the source system.This is a suitable technique for troubleshooting but is not a suitable technique for forensic purposes. In that case you really either need to mount it in an operating system that does support read-only mounts, or, best of all, use a hardware-based write-blocker. For serious forensic work you should always use a hardware write-blocker in every step of the process (and you should always be working with images of the original drive after you image and create a signature for the original drive).
As an alternative method, I would consider imaging the source drive with a non-Windows operating system onto a new drive, and working with the new drive in Windows.
N.B. This does not work in XP, since the XP edition of diskpart does no include the "attrib" command that the answer relies on.
I'm answering quite late, but it might help someone else.
Everett's solution on superuser explains how to modify the volume attributes to make it read-only.
You can use WriteProt, a little command line tool that enables you to write protect a filesystem on Windows.
I've got this bookmarked from a while back, but I've never tried it: http://www.microsoft.com/communities/newsgroups/list/en-us/default.aspx?dg=microsoft.public.windows.file_system&tid=4b1a14f7-6bd2-4c9f-ae64-df57c35712bf&cat=&lang=&cr=&sloc=&p=1
The 4th post (by Edwin) has the solution I am talking about.
Solution:
From: http://www.autorunremover.com/
"You can set the USB port status to Read only or Readable/Writable with Autorun Virus Remover ..."
Conclusion: if you place your hard drive in an external hard drive case with a USB cable, you can ensure that its mounted as read only.
According to Software Informer there is over 4,078 people with this utility installed on their computer as of 2009-07-07.
Note of caution: when this utility is installed for the very first time it scans external hard drives. Suggest a thorough test flight on another external USB drive before committing your life to it.
I have never done this, but once its installed find it under My Computer. Then right-click and select properties then security tab. You maybe able to configure the permissions for what you are looking for.
EDIT - after reading your entire post and EA's answer, the hardware write-blocker sounds best.
note to self - read ENTIRE post before responding and try not to feel like this is a race to beat EA
As Evan says there's no easy way of doing this other than to clone the drive. There's a linux live distro called PING that you can use to boot a machine, and it gives you the facility to copy partitions between hard drives (and it's free & pretty easy to use)
There is a way to access the drive in a mode that is effectively read only.
Now, do all of your access through the UNC file share, e.g. \computer\mydrive - RO\
I use this trick to provide an absolute guarantee that my file backup program won't inadvertently stomp on the data that its meant to be backing up.