>>>>       Not sure, but could you try to also mount the disk with the 
>>>> noatime
>>>> option. I don't know if ro implies noatime.
>>> I remember an article in german "Linuxmagazin" ~ 10 Jears ago where 
>>> it said that the stock kernel drivers for all journaling file 
>>> systems on linux are broken for forensic analysis due to the fact 
>>> that these drivers always update the journal despite the filesystem 
>>> mounted read only. Looks like that statement is still true.

>>> The workaround given that time was to make a image of the whole 
>>> device, make that image immutable, and mount the partions of that 
>>> image.
>> Would mounting as ext2 (non journaling) help in that case ?
>     Why not try it? ext2, ro, noatime.