Why Should I Remount Disks/Partitions In Read-Only Mode?

Short answer: Remounting a source drive in read‑only mode protects what’s left of your data. It prevents your OS, background services, and even repair tools from writing new metadata or files that could overwrite the very sectors you’re trying to recover. Disk Drill follows this best practice by scanning in read‑only mode whenever possible and can remount target volumes as read‑only for you.

What “Read‑Only Mode” Actually Is

At the operating system level, read‑only means the file system is mounted with flags that disallow writes—no journal updates, no metadata changes, no new files, no deletes. On macOS, diskutil mount readOnly passes the same semantics as the BSD mount(8) rdonly option; even the super‑user can’t write to the volume while it’s mounted that way. 

On Windows, read‑only can be applied at the disk or volume scope via DiskPart attributes. When set, Windows treats the target as write‑protected until you clear the attribute. (Scope details vary by disk type and partitioning scheme.) 

Why Read‑only Mounts Are Critical for Recovery

Even simple actions—opening a folder, generating thumbnails, Spotlight/Indexing, antivirus scans, Crash/Diagnostic logs, or auto‑repair tools—can cause silent writes. Those writes update journals, allocation maps (e.g., APFS/HFS+), or the MFT (NTFS) and may overwrite previously deleted data. That’s why the safest approach is to remount the source read‑only before you scan. Disk Drill’s own docs warn that a system may still access the device while you browse scan results unless it’s locked down. 

SSDs & TRIM: If the OS already told the SSD to discard freed blocks, recovery chances drop. You can’t “undo” a TRIM, but you can prevent additional writes by switching the device to read‑only and working from a byte‑to‑byte image.

Forensics/chain of custody: Read‑only access (or a hardware write‑blocker) is standard practice to preserve evidence integrity.

How Disk Drill Protects Your Data

• Scans in read‑only mode (by design): Disk Drill performs scans without writing to the source media.
• One‑click read‑only remount: In Disk Drill, you can manually set a device to Read‑Only by right‑clicking the device in the disk list and selecting Remount volume as read‑only option before you scan. You’ll see a R/O icon next to the volume name.
• Automatic protection when possible: When conditions allow, Disk Drill will automatically switch the scanned drive into read‑only to minimize overwrite risk.
• Internal system disk: You can’t remount the live internal system volume read‑only from the running OS. Best practice: create a byte‑to‑byte disk image (if possible) and scan the image, not the hardware.

How to Remount a Disk or Partition as Read-Only

The safest way to run data recovery is to remount the source volume in read‑only mode so the OS can’t overwrite recoverable data. Below are three fast methods—starting with the one‑click option in Disk Drill, followed by command‑line steps for macOS and Windows.

1. Disk Drill (quick method)

1. Select the disk or partition in Disk Drill’s disk list.
2. Right‑click it to open the context menu.
3. Choose Remount volume as read‑only.

remount disks partitions in read only mode step 01

remount disks partitions in read only mode step 03

You’ll see a R/O icon next to the volume name, confirming that the device is mounted read‑only. This prevents new writes while you scan and recover files.

2. macOS (Terminal)

Works for external drives and non‑system volumes. If you need to protect the internal system disk, create a byte‑to‑byte image or boot from another macOS instance.

1. List devices
   diskutil list
2. Unmount the volume (if it’s mounted)
   diskutil unmount /dev/disk2s1
3. Mount in read‑only mode
   sudo diskutil mount readOnly /dev/disk2s1

3. Windows (Command Prompt, Admin)

You can protect a volume or the entire disk using DiskPart attributes.

1. Open DiskPart
   diskpart
2. Set a disk to read‑only
   list disk

select disk <N>

attributes disk set readonly

How to Return a Disk to Write Mode

When you’re done recovering files in read‑only mode, you can safely remount the disk in read/write mode to resume normal use. Start with Disk Drill’s quick UI method, then use macOS or Windows commands if needed.

1. Disk Drill (quick method)

1. Select the disk or partition in Disk Drill’s disk list.
2. Right‑click it to open the context menu.
3. Select Remount volume in read/write mode.

remount disks partitions in read only mode step 04

remount disks partitions in read only mode step 02

The device will mount in read/write mode so you can modify files again.

2. macOS (Terminal)

If you previously mounted the volume as read‑only, simply unmount and mount it normally:

• diskutil unmount /dev/disk2s1
• diskutil mount /dev/disk2s1

Verify it’s writable (optional):

• mount | grep disk2s1

If the output does not include read-only, the volume is in write mode.

3. Windows (Command Prompt, Admin)

Clear the read‑only attribute for an entire disk you previously set with DiskPart:

• diskpart
• list disk
• select disk <N>
• attributes disk clear readonly
• detail disk

detail disk should report Read-only: No. If it still shows as read‑only, check for BitLocker locks, storage policies, hardware write‑protect switches, or failing media that has entered a firmware‑enforced read‑only state.

Best‑Practice Workflow for Safe Recovery

1. Stop using the affected machine or device immediately.
2. Attach the source drive as a secondary device to a clean computer (avoid booting from it).
3. Remount the source read-only (use OS tools or Disk Drill’s Remount Volume as Read-Only).
4. Create a byte-to-byte image of the entire device and scan the image instead of the hardware whenever possible.
5. Scan with Disk Drill in read-only mode and recover files to a different physical disk.
6. Validate the recovered files before putting the source drive back into service.
7. If the drive shows SMART warnings or intermittent I/O errors, image first and minimize retries—intensive scanning can accelerate failure.