How-To: Mount a Strange NTFS Drive on Linux Without Trusting It

The Linux 7.4 NTFS3 fixes are a good reminder that a file system is attack surface. Here’s how I handle a drive I didn’t format myself.

Review before you run anything: read the docs yourself, back up your config, and try it somewhere you can afford to break first.

1. Look before you mount

lsblk -f

Find the partition and confirm it’s NTFS.

2. Mount it read-only and locked down

sudo mkdir -p /mnt/strange
sudo mount -t ntfs3 -o ro,nosuid,nodev,noexec /dev/sdX1 /mnt/strange

Replace sdX1 with your partition. Read-only means nothing gets written, and noexec stops you from running anything off it by accident.

3. Copy out only what you need, then unmount

sudo umount /mnt/strange

4. Keep your kernel current

Driver hardening only helps once you’re running it. On Omarchy and Arch that means staying on top of updates and keeping a fallback kernel.

5. Really untrusted? Use a throwaway VM

Pass the USB device through to a disposable VM and let that kernel take the risk.

God Bless, and Happy hacking!

References & Further Reading

• NTFS3 Hardened In Linux 7.4 (Phoronix)
• mount(8) manual page
• How-To: Keep a Fallback Kernel on Omarchy and Switch the Default (EtherNinja)