1
Say you take a disk image file and you "mount" it, is it possible for that file to be changed in anyway by the very act of mounting it?
(I'm mainly interested in Mac and Windows, but also POSIX.)
Pacerier
Posted 2018-03-02T23:52:56.740
Reputation: 22 232
2
Absolutely. Mounting an image is exactly like mounting a drive to the VFS, the only difference is where the VFS points its routines at. If the filesystem driver doesn't have write support (e.g. ISO9660 or DMG) then there's no way to change the image, but things such as the ext* dirty bit will still be frobbed.
Ignacio Vazquez-Abrams
Posted 2018-03-02T23:52:56.740
Reputation: 100 516
Does this include read-only mounts (like what Mac does by default when you doubleclick it)? ¶ Say you mount an image as "read-only", can a virus somehow bypass that? – Pacerier – 2018-03-03T00:15:34.120
I don't know enough about OS X to be able to answer that. – Ignacio Vazquez-Abrams – 2018-03-03T00:16:12.800
I mean talking about "read-only mounts" in general? – Pacerier – 2018-03-03T00:17:14.070
1If you e.g. mount -o ro then the VFS will prevent writing to the image. A R/W remount can be attempted though. – Ignacio Vazquez-Abrams – 2018-03-03T00:18:21.243
1If it's a journalling file system, couldn't there be journal entries even when mounted in read-only mode? – AFH – 2018-03-03T01:23:13.107
They could exist, but they can't be replayed to the filesystem. – Ignacio Vazquez-Abrams – 2018-03-03T01:56:12.757
2
The act of actually mounting it won't change the image, however part of the greater mounting process may include file system checks etc which could change the image. I guess if you are concerned about this you would mount an image Read-Only - but then you won't be able to mount it.
davidgo
Posted 2018-03-02T23:52:56.740
Reputation: 49 152
Re "mount an image Read-Only - but then you won't be able to mount"; ?? – Pacerier – 2018-03-03T00:12:16.790
Of-course you will - assuming the filesystem is clean. – davidgo – 2018-03-03T00:15:20.333
I mean your above statement contradicts itself... ¶ Separately, what do you refer to by the "greater mounting process"? – Pacerier – 2018-03-09T23:13:54.477
Mounting is the process of connecting a block device and making it available to the OS. When mounting a disk, the OS will recognise the type of filesystem and - and this is what I mean by greater mounting process - and could - depending on the file system type and mount options - kick off a process to clean the filesystem - but this later function is not intrinsic to the mount procedure. – davidgo – 2018-03-09T23:39:48.230
FYI, you could easily check for yourself. Run a hash check (MD5, SHA, etc) on the disk image before mounting the drive, then after. – Keltari – 2018-03-03T00:19:48.460
@Keltari, Yea it doesn't change for my particular test. hence the question. – Pacerier – 2018-03-03T00:21:38.520
If it doesnt change, then there is your answer. However, your particular test might not be the right "question" – Keltari – 2018-03-03T00:22:30.167
@Keltari, ?͏͏͏͏ – Pacerier – 2018-03-09T23:12:03.977