How to mount NTFS partition in MAC with read and write support

In this article we are going to discuss how to mount an external storage, with read & write support in case where drive is formatted as NTFS.

Your Mac can read NTFS drives, transferring content from the drives to another place, but it cannot write to NTFS drives.

Note: Write support for NTFS drives can be added through open-source programs, paid programs, or Apple’s own experimental drivers. Mac OS X has a hidden option to enable write support to drives formatted as NTFS. However enabling NTFS write support on the Mac is not officially supported by Apple.

In order to mount storage with read-write support, we are going to use Apple’s Experimental NTFS support, which in turn uses in-built command line tools i.e. you need not to install any third party softwares.

Start Terminal and create a mount point

$ sudo mkdir -p ~/Desktop/MalForensicsLab/MountPoint/

Enter below command to list the disks

$ diskutil list

This will list down all disks attached to Mac and its partitions.

/dev/disk0 (internal, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *121.3 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:                 Apple_APFS Container disk1         121.1 GB   disk0s2

/dev/disk1 (synthesized):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      APFS Container Scheme -                      +121.1 GB   disk1
                                 Physical Store disk0s2
   1:                APFS Volume Macintosh HD            110.2 GB   disk1s1
   2:                APFS Volume Preboot                 42.0 MB    disk1s2
   3:                APFS Volume Recovery                512.8 MB   disk1s3
   4:                APFS Volume VM                      4.3 GB     disk1s4

/dev/disk2 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:     FDisk_partition_scheme                        *500.1 GB   disk2
   1:               Windows_NTFS STORAGE                 500.1 GB   disk2s1

In current scenario, we can see that disk2s1 is identifier of disk partition formatted as NTFS. Now run below command to first unmount the partition

$ diskutil unmount /dev/disk2s1

Once its unmounted, you can run below command to mount NTFS partition with read & write support

$ sudo mount -t ntfs -o rw,auto,nobrowse /dev/disk2s1 ~/Desktop/MalForensicsLab/MountPoint/

You can now read and write content to partition formatted as NTFS.