I have a 500GB raw disk image file on my HDD that I’ve called
dysk.img and that is a result of
dd'ing the contents of an external single NTFS partion drive. Its purpose is to attempt data recovery with the
ntfsundelete program (and the results of the initial scan are promising).
Before that, however, I’d like to examine its current, not deleted content. Thus I’d like to mount it. For obvious reasons, I want to ensure that mounting this file will not result in a single bit being written to it.
mount --read-only doesn’t seem to be the solution, sadly. Because, according to
Note that, depending on the filesystem type, state and kernel behavior, the system may still write to the device. For example, ext3 and ext4 will replay the journal if the filesystem is dirty. To prevent this kind of write access, you may want to mount an ext3 or ext4 filesystem with the ro,noload mount options or set the block device itself to read-only mode, see the blockdev(8) command.
Can the above apply to NTFS as well? Sadly
mount doesn’t support the
Unfortunately, I had carelessly written some files with Windows-incompatible names (containing the
? character for instance), and this had made Windows mark this filesystem for scheduled check – thus, I’m getting constant warnings from
ntfsundelete now and cannot run
ntfsundelete without the
--force option. Can this further increase the risk of some accidental writes?
As of now, only root has write access to this file. I’m not sure if this is enough, as IIUC there’s always some rights elevation when mounting.
root the owner of this file and denying anyone, even the owner, write access be helpful?
Would it be helpful to attempt to use the
blockdev command suggested by
man mount to this file? Or would it be risky or harmful to issue
blockdev --setro to an image file, as opposed to an actual device?
chattr +ithe image file. :) Now, allow me to make a small self-promotion... my open source software called RecuperaBit reconstructs NTFS and it doesn't write anything on the image file.