On Thu, Aug 18, 2016 at 05:09:28PM -0400, Renaud OLGIATI wrote:
> On Thu, 18 Aug 2016 22:48:39 +0200
> "Dr. Nikolaus Klepp" <dr.klepp@???> wrote:
>

> > >      Not sure, but could you try to also mount the disk with the noatime 
> > > option. I don't know if ro implies noatime.  

> >
> > I remember an article in german "Linuxmagazin" ~ 10 Jears ago where it
> > said that the stock kernel drivers for all journaling file systems on
> > linux are broken for forensic analysis due to the fact that these
> > drivers always update the journal despite the filesystem mounted read
> > only. Looks like that statement is still true.
> >
> > The workaround given that time was to make a image of the whole device,
> > make that image immutable, and mount the partions of that image.
>
> Would mounting as ext2 (non journaling) help in that case ?

You can't mount ext4 as ext2 because of extents and a bunch of other
features.

To disable journal recovery mount with -oro,norecovery, very recently a
bunch of filesystems either gained this option or aliased their existing
options (like nologreplay) to that.

--
An imaginary friend squared is a real enemy.