I recently had reason to move a hard drive from a computer that blew up to another computer for the purpose of recovering data. Under the (unfortunate) circumstances, both the donor and the recipient were Windows XP SP3 machines. I wanted to be sure that the transplanted drive would not be altered by the recipient computer, so I searched like hell but was unable to find a way to mount the transplanted drive as read-only.
How can I mount a hard drive as read-only on Windows XP?
Best Answer
There is a built-in mehanism to mount a filesystem read-only in Windows, sort of. It's definitely not like a read-only mount on a *nix operating system.
This Superuser.com answer has details. The change you're making using
diskpartto toggle areadonlyattribute on the volume is making changes to the "read-only" disk. You're modifying the disk to prevent it from being modified. In particular, toggling this bit and forgetting to toggle it back off prevents Windows from booting when you return the disk back to the source system.This is a suitable technique for troubleshooting but is not a suitable technique for forensic purposes. In that case you really either need to mount it in an operating system that does support read-only mounts, or, best of all, use a hardware-based write-blocker. For serious forensic work you should always use a hardware write-blocker in every step of the process (and you should always be working with images of the original drive after you image and create a signature for the original drive).
As an alternative method, I would consider imaging the source drive with a non-Windows operating system onto a new drive, and working with the new drive in Windows.
N.B. This does not work in XP, since the XP edition of diskpart does no include the "attrib" command that the answer relies on.