Ubuntu mounts external ntfs drive as read-only?

I am an infrequent Ubuntu / Linux user, only use it in case of major disaster (in this case Ransom-ware nuclear, but that's another story).

So i booted up another laptop using Ubuntu from a USB-drive; inserted my external ntfs drive, and it gets recognized automatically, but if i try to create a new folder / drive anywhere, the "file manager" interface just closes down, and i have to launch it again (try again, rinse and repeat).

This leads me to guess my ext.drive was mounted in read-only mode by default.

Q1. How / where can i verify it is mounted in read-only mode?

Q2. What's the best way to make it mount in read-write mode?

Solution 1:

This is a common question and has been answered numerous times in AskUbuntu (for example, here).

In short, you probably have fast boot turned on in Windows, which is why Linux will only mount it in read-only mode.

You should also have ntfs-3g installed, which you likely will because it is installed by default on Ubuntu

Q1. Just mount your Windows partition and see if you can create or edit a file there.

Q2. To mount it reliably in read-write mode, you need to disable fast boot in Windows. Then just double click the Windows partition in your file manager. Alternatively, you can do it from the terminal:

Find out which partition is your windows partition:

[van@z97:mnt]$ lsblk -f
NAME           FSTYPE   LABEL    UUID                                 MOUNTPOINT
loop0          squashfs                                               /snap/ohmygiraffe/3
loop1          squashfs                                               /snap/core/2844
loop2          squashfs                                               /snap/core/2774
loop3          squashfs                                               /snap/core/2898
sda                                                                   
├─sda1         ntfs     Recovery E6A60CE2A60CB559                     
├─sda2         vfat              A80E-CD6E                            /boot/efi
├─sda3                                                                
├─sda4         ntfs              3C5E17DD5E178F30                     
├─sda5         swap              e0f12aa3-2b9f-4e04-a91d-806a9eccb688 
│ └─cryptswap1 swap              c738647d-8719-4f4e-b454-14802635d295 [SWAP]
└─sda6         ext4              4295796e-0535-4fbf-843d-7c9970c9155e /
sdb                                                                   
├─sdb1         ext4              4c9ee94a-d2b3-46a0-99a7-7f434814bda5 /home
└─sdb2         ext4              cc902d7c-591b-4a44-8b68-51a7ca7c4e7f /opt

In my example above, it's sda4.

Now mount it to mount-point /mnt/windows:

sudo mount -t ntfs /dev/sda4 /mnt/windows
ls /mnt/windows

Then just navigate to /mnt/windows in your file manager and create a test text file and make sure you can save it.

You can umount the mount using:

sudo umount /mnt/windows

Solution 2:

If valuable data, do the repair work on a cloned copy

• If the data, that you want to recover are valuable, it is a good idea to clone the drive to another drive of at least the same size and to do the repair work on the cloned copy. This way you dare try potentially risky methods. If things go wrong, you can clone again, and try something else without losing your data. See this link,

  • Repair the partition table and file system of a pendrive, scroll to 'Advanced repair ...'

Different causes of your problem to mount the NTFS file system

There could be different causes why you cannot mount the NTFS file system.

• The file system needs repair and that, for NTFS, should be done in Windows, as suggested by @MichaelBay. If Windows in your current system does not work, you could connect the drive to another computer with Windows and do the job. But I can understand, that you would hesitate to do that because of the suspected ransomware malware.

• Windows is hibernated or semi-hibernated, which means that the file system is in a state, that would be damaged, if written to by another operating system. The solution in this case is to

  • boot into Windows if possible, and reboot (not shut down)
  • turn off fast startup in Windows, which is a kind of semi-hibernattion

• The automatic process is mounting the NTFS partition read-only although it can be mounted read-write. If this is the problem, you can unmount it and mount it manually with read-write permissions.

  You can check if a partition is mounted read-only ro or read-write rw in the file /etc/mtab

  less /etc/mtab
  

  or specifically with grep, for example with

  grep 'ro,' /etc/mtab
  grep '^/dev/' /etc/mtab
  

  See these links,

  • Unable to access SD Card

  • How do I use 'chmod' on an NTFS (or FAT32) partition?

  • The same syntax is used to mount NTFS and FAT32 file systems in linux, so instructions for FAT32 can be used for NTFS.