This is a suggestion to improve forensic mode.

Forensic mode could provide more protection against inadvertently/accidentally writing to a drive. A goal should be that the user must perform some affirmative action to allow anything to write to the drive.

Currently partitions are not auto-mounted in forensic mode. But if the user wants to mount a partition, they have to:

• Remember to use the "ro" (read only) mount option (and maybe noatime for some filesystems?)
• Are dependent on the filesystem being nice and obeying "ro". Some don't, for example ext3/ext4 replay the journal even when you mount ro. You have to specify the noload option to prevent that.

With both those points, it's very easy for a user to accidentally cause the disk to be written to.

A couple of suggested solutions. Probably neither is very easy to implement though...

• Make all block devices default to read-only when they are created. The user would have to manually do e.g. blockdev --setrw /dev/sdb before being able to mount the device read-write.

• Make loop,ro default mount options. That causes the loopback device to be read-only, so filesystems can't ignore that and write to disk anyway. The user would have to manually specify rw or noloop,rw when mounting to mount read/write.

The first one is better I think.