🐧 "mount -o ro" does not write-protect last access dates on NTFS.

(I am not looking for support with this post; it is just for information.) Looks like "mounting as read-only" is not the write-proof wall one might think it is.

After attaching an NTFS hard drive, I mouned it as read-only using mount -o remount,ro. Then I read a file's last access date using the "stat" command. It was a date in March 2022. Then, I opened that PNG file inside Firefox, ran stat on it again, and its last access time was reset (2022-06-21 22:51:09).

I first assumed that the new last access time is just in the RAM, not on the actual drive. I disconnected the drive, reconnected it, mounted it as read-only, and the last accessed time was still 2022-06-21 22:51:09.

This means the contents of the file system were modified despite of the read-only option. Needless to say, this made me lose trust in it, since it is not that write-proof wall I thought it is. Apparently, this behaviour is specific to NTFS, since it has not happened so far with FAT32, exFAT, or ext4. Looks like the only way to actually write-protect a drive is on controller level.

Obviously, mount -o ro can not protect from writes by tools that access the device on block level, but file attributes are on file system level. On other file systems like FAT*, it does protect from changing last access dates, but not on NTFS.