Ubuntu mounts external ntfs drive as read-only?

Question

I am an infrequent Ubuntu / Linux user, only use it in case of major disaster (in this case Ransom-ware nuclear, but that's another story).

So i booted up another laptop using Ubuntu from a USB-drive; inserted my external ntfs drive, and it gets recognized automatically, but if i try to create a new folder / drive anywhere, the "file manager" interface just closes down, and i have to launch it again (try again, rinse and repeat).

This leads me to guess my ext.drive was mounted in read-only mode by default.

Q1. How / where can i verify it is mounted in read-only mode?

Q2. What's the best way to make it mount in read-write mode?

Solution 1

This is a common question and has been answered numerous times in AskUbuntu (for example, here).

In short, you probably have fast boot turned on in Windows, which is why Linux will only mount it in read-only mode.

You should also have ntfs-3g installed, which you likely will because it is installed by default on Ubuntu

Q1. Just mount your Windows partition and see if you can create or edit a file there.

Q2. To mount it reliably in read-write mode, you need to disable fast boot in Windows. Then just double click the Windows partition in your file manager. Alternatively, you can do it from the terminal:

Find out which partition is your windows partition:

[van@z97:mnt]$ lsblk -f
NAME           FSTYPE   LABEL    UUID                                 MOUNTPOINT
loop0          squashfs                                               /snap/ohmygiraffe/3
loop1          squashfs                                               /snap/core/2844
loop2          squashfs                                               /snap/core/2774
loop3          squashfs                                               /snap/core/2898
sda                                                                   
├─sda1         ntfs     Recovery E6A60CE2A60CB559                     
├─sda2         vfat              A80E-CD6E                            /boot/efi
├─sda3                                                                
├─sda4         ntfs              3C5E17DD5E178F30                     
├─sda5         swap              e0f12aa3-2b9f-4e04-a91d-806a9eccb688 
│ └─cryptswap1 swap              c738647d-8719-4f4e-b454-14802635d295 [SWAP]
└─sda6         ext4              4295796e-0535-4fbf-843d-7c9970c9155e /
sdb                                                                   
├─sdb1         ext4              4c9ee94a-d2b3-46a0-99a7-7f434814bda5 /home
└─sdb2         ext4              cc902d7c-591b-4a44-8b68-51a7ca7c4e7f /opt

In my example above, it's sda4.

Now mount it to mount-point /mnt/windows:

sudo mount -t ntfs /dev/sda4 /mnt/windows
ls /mnt/windows

Then just navigate to /mnt/windows in your file manager and create a test text file and make sure you can save it.

You can umount the mount using:

sudo umount /mnt/windows

Solution 2

If valuable data, do the repair work on a cloned copy

• If the data, that you want to recover are valuable, it is a good idea to clone the drive to another drive of at least the same size and to do the repair work on the cloned copy. This way you dare try potentially risky methods. If things go wrong, you can clone again, and try something else without losing your data. See this link,

  • Repair the partition table and file system of a pendrive, scroll to 'Advanced repair ...'

Different causes of your problem to mount the NTFS file system

There could be different causes why you cannot mount the NTFS file system.

• The file system needs repair and that, for NTFS, should be done in Windows, as suggested by @MichaelBay. If Windows in your current system does not work, you could connect the drive to another computer with Windows and do the job. But I can understand, that you would hesitate to do that because of the suspected ransomware malware.

• Windows is hibernated or semi-hibernated, which means that the file system is in a state, that would be damaged, if written to by another operating system. The solution in this case is to

  • boot into Windows if possible, and reboot (not shut down)
  • turn off fast startup in Windows, which is a kind of semi-hibernattion

• The automatic process is mounting the NTFS partition read-only although it can be mounted read-write. If this is the problem, you can unmount it and mount it manually with read-write permissions.

  You can check if a partition is mounted read-only ro or read-write rw in the file /etc/mtab

  less /etc/mtab
  

  or specifically with grep, for example with

  grep 'ro,' /etc/mtab
  grep '^/dev/' /etc/mtab
  

  See these links,

  • Unable to access SD Card

  • How do I use 'chmod' on an NTFS (or FAT32) partition?

  • The same syntax is used to mount NTFS and FAT32 file systems in linux, so instructions for FAT32 can be used for NTFS.

Solution 3

In my case, the problem was that I had disk caching activated in Windows. The solution was simple: disable disk caching on the drive in Windows.

After using Windows to disable disk caching on my portable USB NTFS formatted drive, I could then automatially mount the drive on my linux machine and both read and write to the disk from linux as well as on Windows.

To disable write-caching in Windows, do the following steps:

1. Right-click on the drive in Windows Explorer.
2. Open Properties.
3. Go to the Policy tab.
4. Uncheck "Enable write caching..."

Comments

[Admin]

It seems the file system needs repair and that, for NTFS, should be done in Windows.

[joedotnot]

@MichaelBay, i respectfully disagree, "should be done in Windows" sounds like you are a casual linux user too :-)

[Admin]

No, it's because there are no good tools to correct NTFS in Ubuntu or others. I'm actually using Ubuntu 99% of the time for many years. Perhaps that's why I never had disasters not even minor ones. Minor inconveniences at most.

[Rinzwind]

@joedotnot he is correct. Problems with ntfs should be fixed from windows. There are tools in Linux but there is never a 100% guarantee with those. And fixing it from Ubuntu means you remove the hibernation file. Basically you remove anything windows has not yet saved to disk. A very very bad idea.

[joedotnot]

@Rinzwind. i got hit by ransomware, my main concern is not to care about the hibernation file, its probably corrupted anyway, including the whole of the windows OS. My priority is salvaging whatever was not encrypted yet by the ransomware onto an external HDD. A very very good idea. Then re-install Windows afresh.

[joedotnot]

your bullet point 3 is my case. "The automatic process is mounting the NTFS partition read-only although it can be mounted read-write." That's what i made clear in my question, where i said I inserted my external ntfs drive, and it gets recognized automatically (and i can view files on it, but not write). Your less /etc/mtab helped to verify /dev/sdb4 is mounted ro. Answer upvoted.

[sudodus]

I'm glad that this answer helped you solve your problem :-)

[Joe]

Fast boot in windows is what screwed me over here, Thank you so much for this I would have never been able to resolve this. I booted my drives accidentally with windows OS & shut it down before it loaded (in haste, to replugin the drives) & then came across this error because I couldn't write anything to the damn drive no matter what I tried.

[Newbie]

Thank you. For me, the problem was "Fast Startup".