In this article we are going to discuss how to mount an external storage, with read & write support in case where drive is formatted as NTFS.
Your Mac can read NTFS drives, transferring content from the drives to another place, but it cannot write to NTFS drives.
Note: Write support for NTFS drives can be added through open-source programs, paid programs, or Apple’s own experimental drivers. Mac OS X has a hidden option to enable write support to drives formatted as NTFS. However enabling NTFS write support on the Mac is not officially supported by Apple.
In order to mount storage with read-write support, we are going to use Apple’s Experimental NTFS support, which in turn uses in-built command line tools i.e. you need not to install any third party softwares.
Start Terminal and create a mount point
$ sudo mkdir -p ~/Desktop/MalForensicsLab/MountPoint/
Enter below command to list the disks
$ diskutil list
This will list down all disks attached to Mac and its partitions.
/dev/disk0 (internal, physical): #: TYPE NAME SIZE IDENTIFIER 0: GUID_partition_scheme *121.3 GB disk0 1: EFI EFI 209.7 MB disk0s1 2: Apple_APFS Container disk1 121.1 GB disk0s2 /dev/disk1 (synthesized): #: TYPE NAME SIZE IDENTIFIER 0: APFS Container Scheme - +121.1 GB disk1 Physical Store disk0s2 1: APFS Volume Macintosh HD 110.2 GB disk1s1 2: APFS Volume Preboot 42.0 MB disk1s2 3: APFS Volume Recovery 512.8 MB disk1s3 4: APFS Volume VM 4.3 GB disk1s4 /dev/disk2 (external, physical): #: TYPE NAME SIZE IDENTIFIER 0: FDisk_partition_scheme *500.1 GB disk2 1: Windows_NTFS STORAGE 500.1 GB disk2s1
In current scenario, we can see that disk2s1 is identifier of disk partition formatted as NTFS. Now run below command to first unmount the partition
$ diskutil unmount /dev/disk2s1
Once its unmounted, you can run below command to mount NTFS partition with read & write support
$ sudo mount -t ntfs -o rw,auto,nobrowse /dev/disk2s1 ~/Desktop/MalForensicsLab/MountPoint/
You can now read and write content to partition formatted as NTFS.