Introducing NTFS

A filesystem is the basic scheme for organizing data on a hard disk drive. The common FAT filesystem, supported by just about every operating system, is just too basic for modern operating systems. Microsoft introduced the advanced NTFS filesystem with their Windows NT operating system in 1993. Borrowing from OS/2′s HPFS and VMS’ Files-11, NTFS is a journalling filesystem with many features, including POSIX links, alternate data streams, sparse files, compression, and encryption.

Although just about everything Microsoft produces is maligned by UNIX and Mac geeks, this hatred is unwarranted in the case of the many storage advances coming out of Redmond. Microsoft may be fairly criticized for producing expensive, proprietary systems, but they have dome some amazing things with disks, and NTFS is arguably one of the most advanced filesystems in wide usage. Much of this credit goes to Windows NT architect Dave Cutler, who also led development of DEC VMS, the RISC concepts that became Alpha, and Microsoft’s Azure cloud platform.

Although every version of Windows supports evolutions of the old FAT filesystem, modern iterations increasingly require NTFS. Windows XP allowed either FAT32 or NTFS for booting; Windows Vista could be forced to boot from FAT32; Windows 7 requires NTFS. Therefore, most PC hard disk drives, including external USB drives, now come formatted with NTFS by default.

NTFS on Mac OS X

This leads to issues for Mac users, especially when they dual-boot with Boot Camp or buy external hard disk drives. As mentioned, all versions of Mac OS X since 10.3 “Panther” have included read-only NTFS support, but those wanting full access had two options:

1. Paragon Software’s NTFS for Mac OS X is a full and supported read/write solution. Although available for purchase separately, many hard disk drives like the Seagate GoFlex now include a free copy of Paragon NTFS.
2. The open source NTFS-3G driver has also been ported to Mac OS X, allowing read/write support for free.

Mac OS X 10.6 “Snow Leopard” adds a third alternative: Native read/write support for NTFS. But it’s not as simple as that. Although early betas enabled read/write support by default, it was limited once again to read-only in the final releases.

It is possible and even simple) to enable read/write support with the native Snow Leopard drivers, but this is definitely an “at your own risk” proposition. Users have reported kernel panics when using these methods, and although I have not heard of data corruption, it is possible as well.

The Manual Method: mount_ntfs

Making disks available is called “mounting” in UNIX geek-speak, and mount commands in modern operating systems are like ogres: They have many layers. Plug in a drive, and Mac OS X makes it available for you using a layer cake of commands, but the bottom-most command is “mount”. This simple command-line utility takes a few arguments and attaches a raw disk device to a point in the unified filesystem tree.

When presented an NTFS drive, Mac OS X calls a utility called mount_ntfs that resides in the /sbin directory, and we can call it, too. Although OS X always tells mount_ntfs to mount NTFS drives read-only, we can tell it to enable writing as well by using the “-o rw” flag.

There’s just one problem: Where should we connect the NTFS file system? Mac OS X automatically creates a new directory (called a “mount point” in UNIX-speak) in /Volumes with the name of the filesystem. For example, the GoFlex drive I bought yesterday mounts as “/Volumes/FreeAgent GoFlex Drive” by default. But mount_ntfs won’t create this mount point, so we have to do it.

Here are the steps to mount an NTFS drive read/write from the command line:

1. Plug in the drive and let Mac OS X mount it read-only.
2. Look in Finder to see the name of the drive. For example, my drive mounts with the name “FreeAgent GoFlex Drive” and this is what shows up on the desktop and in Frinder under “Devices”.
3. Open the Terminal application to get command-line access. We’ll use “sudo” which executes commands as the administrator instead of a regular user.
4. Type the following command in Terminal to get necessary information about the drive. Use the drive name you see in Finder in place of “drive name”, and make sure to use quotation marks around it since Terminal treats un-quoted spaces as separators rather than part of the name.

   diskutil info "/Volumes/drive name"

5. Record the “Device Node” entry, which will look something like “/dev/disk4s1″. This is where the raw partition is mapped by the disk subsystem, and where the filesystem driver will read its data.


The diskutil command gives us the "Node Name", which we'll need momentarily

6. Eject the drive, using option-click in Finder or with the hdiutil command in Terminal:

   hdiutil eject "/Volumes/drive name"

7. Now you must create the mount point again. Type the following:

   sudo mkdir "/Volumes/drive name"

8. Finally, use mount_ntfs to mount the drive read/write using the following command. Use the node name you spotted above and the mount point you just created:

   sudo mount_ntfs -o rw /dev/disk?s? "/Volumes/drive name"

9. When you’re done, you can use the Finder, the hdiutil command, or just about anything else to eject the drive. Make sure your mount point is deleted as well!

This method is great for occasional NTFS use, which is frankly all Mac users should need. If you intend to use a drive frequently, I highly recommend reformatting it with the native HFS+ filesystem since it will be fully-supported by the operating system.

The Per-Drive Method

Let’s say you have an NTFS drive you frequently need to mount read/write and find the above method too much of a hassle. Maybe it’s your Boot Camp drive, or perhaps it’s a USB hard disk drive you share with a Windows-using colleague. It is possible to tell Mac OS X to always mount a given NTFS drive read/write using its native driver using the following commands. However, I recommend investing in the Paragon driver for this use case, since it’s fully-supported!

Like all UNIX systems, Mac OS X uses a configuration file to determine what it should do with certain drives. This file, called “fstab” and located in “/etc”, is not present by default but will override the “read-only” flag on a per-drive basis if found. This allows a drive to always be mounted read/write without any hassle.

1. Get the drive name as in step 2 above.
2. Open Terminal and type the following command to edit the /etc/fstab file:

   sudo nano /etc/fstab



Adding a line in /etc/fstab will make Mac OS X always mount a single drive in read/write mode

3. “Nano” is a command-line editing program. Add the following line to the file (and don’t forget the quotes around the drive name if it contains spaces!)

   LABEL="drive name" none ntfs rw

4. Now type control-x to save and exit, type y for yes, and hit enter.
5. After a reboot, Mac OS X should automatically mount any drive with that label as read/write

Note that this can also be done using the NTFS UUID of the drive, but this isn’t present on every drive to LABEL works better. Also, some have reported needing multiple reboots to make it work. I have no idea why.

The Permanent Universal Method

It is also possible to permanently modify how Mac OS X calls the mount_ntfs command to always mount every NTFS drive in read/write mode. Again, I will point out that this isn’t necessarily a great idea since Apple doesn’t support using the driver in this way. But here it is!

1. Open Terminal. We won’t need the drive name or Node Name since this applies to every NTFS drive.
2. Rename the mount_ntfs command to something else by typing the following:

   sudo mv /sbin/mount_ntfs /sbin/mount_ntfs_orig

3. Create a shell script called mount_ntfs using the Nano editor:

   sudo nano /sbin/mount_ntfs

4. This script will simply call mount_ntfs with the “-o rw” flag every time it’s used. Type the following in Nano:

   #!/bin/sh
   /sbin/mount_ntfs_orig -o rw "$@"

5. Type control-x to save and exit, type y for yes, and hit enter.
6. Now we’ll fix the permissions on this new file so it’s owned by root and group wheel:

   sudo chown root:wheel /sbin/mount_ntfs

7. Finally, we make the shell script executable:

   sudo chmod 755 /sbin/mount_ntfs

8. Now every time OS X encounters an NTFS drive, it will mount it read/write by calling this script rather than the “mount_ntfs” executable it thinks it’s using.

Note that future OS updates might “break” this method by replacing the /sbin/mount_ntfs command, or it could cause other issues. But it works for now and doesn’t even require a reboot.

Stephen’s Stance

I’m hesitant to recommend that casual Mac users employ any of these methods to access NTFS drives. Each requires superuser access and careful typing. You can easily mess up your system this way, and unsupported uses of the NTFS driver might result in data loss.

If you aren’t comfortable with this kind of mucking-about or intend to frequently write to NTFS drives, I highly suggest installing NTFS-3G or Paragon’s NTFS driver. In fact, the best method is simply to go buy a Seagate GoFlex drive and use the Paragon driver that comes with it!

But hackers and geeks like me want to know how to do this. This is why I decided to document it here.

Note: Some of these links include affiliate codes that help pay for this blog. For example, buying an Amazon Kindle with this link sends a few bucks my way! But I don't write this blog to make money, and am happy to link to sites and stores that don't pay anything. I like Amazon and buy tons from them, but you're free to buy whatever and wherever you want.

© sfoskett for Stephen Foskett, Pack Rat, 2010. | How To Write To Windows NTFS Drives In Mac OS X 10.6 “Snow Leopard”
This post was categorized as Apple, Personal, Terabyte home. Each of my categories has its own feed if you'd like to filter out or focus on posts like this.

1. Use the excellent and free NTFS-3G driver
2. Buy Paragon Software’s Paragon NTFS

I’ve been using the NTFS-3G driver myself for quite some time. It works as advertised: Install it and you can read and write to NTFS-formatted drives with ease. These drives are integrated right into the Finder, appearing just like Mac-standard HFS+ disks. This is the method I used to assign custom drive icon for my Boot Camp volume and USB drives, for example.

Note: Snow Leopard’s NTFS driver is read/write capable. See my post, How To Write To Windows NTFS Drives In Mac OS X 10.6 “Snow Leopard”

This post is part of my series focused on Apple OS X tips and tricks.

• Access NTFS Volumes On Your Mac
• Clean Up Your Mac! Essential OS X Tidiness Tools and Techniques
• How To Move OS X Time Machine Backups To A New Disk
• Hallelujah! OS X Can Reduce PDF File Size!
• Custom Drive Icons in Mac OS X
• OS X Custom Drive Icons 2: Boot Camp and NTFS

NTFS is a userspace (FUSE) driver, so installing it requires the installation of mac-fuse as well. It’s been nicely packaged for install over at MacNTFS-3G, or you can install it with MacPorts, along with lots of other great UNIX software.

Paragon NTFS functions similarly to NTFS-3G. The latest versions also include an HFS+ driver for Windows, allowing your Boot Camp instance to read your Mac drive, which is pretty cool. I was initially interested in Paragon’s software, thinking it would be more stable and supported than the open source NTFS-3G. But at $40, it’s hard to justify the cost when a free alternative is available. Once I tried the free version from Giveaway-of-the-Day, I know I would have felt cheated if I had spent the money on it. The MacNTFS-3G package is so nicely integrated, there is really no need to fear it. And I’ve had no trouble with it in over a year of use.

The Paragon Giveaway didn’t include the HFS+ driver for Windows, but reports are that Apple will introduce a similar driver with Snow Leopard. I think I’m liking free and bundled software more and more!

Note: Some of these links include affiliate codes that help pay for this blog. For example, buying an Amazon Kindle with this link sends a few bucks my way! But I don't write this blog to make money, and am happy to link to sites and stores that don't pay anything. I like Amazon and buy tons from them, but you're free to buy whatever and wherever you want.

© sfoskett for Stephen Foskett, Pack Rat, 2009. | Access NTFS Volumes On Your Mac
This post was categorized as Apple, Personal, Terabyte home. Each of my categories has its own feed if you'd like to filter out or focus on posts like this.

Yup, my Boot Camp drive icon is customized, too!

In my last post, I discussed the simple but confusing steps required to add custom icons to Mac OS X drives. I mentioned that there were some tricks to getting custom icons on some drives, however, including Boot Camp and NTFS disks. This week, I’ll show how to customize these as well.

There are two core problems with customizing drive icons for certain volumes:

1. OS X can’t directly write to anything but HFS+ and FAT, and this includes writing icons
2. OS X needs a special resource on the drive to indicate that the custom icon should be used, and only HFS+ supports this

But it’s easy enough to get around these limitations. Apple takes care of number 2, and we can cover number 1 in one of two ways.

This post is part of my series focused on Apple OS X tips and tricks.

• Access NTFS Volumes On Your Mac
• Clean Up Your Mac! Essential OS X Tidiness Tools and Techniques
• How To Move OS X Time Machine Backups To A New Disk
• Hallelujah! OS X Can Reduce PDF File Size!
• Custom Drive Icons in Mac OS X
• OS X Custom Drive Icons 2: Boot Camp and NTFS

Techie Bits

Booooooring generic USB drive icon in OS X

Old versions of Mac OS stored lots of data (aka “resources”) in the resource fork of a file, including icon graphics. However, this became a problem with the advent of networking and cross-platform computing, since no other popular personal computing platform supported two-fork files. OS X moves most resources into the data fork – although resource forks still exist, they are rarely used.

However, it appears to me that although the “icns” data for a drive icon is stored in the data fork of the .VolumeIcon.icns file, Apple still uses a pointer in the resource fork of the root directory of the drive to tell OS X to use that icon. In other words, when a drive is mounted, OS X seems to look in the resource fork of “.” for a flag that says “use the icon in .VolumeIcon.icns” before it will use the icon. I’m not sure this is the case, but I do know that .VolumeIcon.icns has no resource fork (even on HFS+), but it requires a special resource file on other filesystems.

Since only HFS and HFS+ support resource forks, this is a problem. Apple gets around this by saving resource fork data in files with “._” prepended to their name. So the resource fork of “index.html” would be “._index.html” on a FAT drive. Every FAT drive I’ve added a custom icon to includes a file called “._.”, which sounds like the root directory’s resource to me, and this is required for the icon to work.

Getting It Done

Aah, that's a much better icon for my Maxtor 3200!

So you need two files on a non-HFS+ drive to get the custom icon to work:
 

1. .VolumeIcon.icns – the same exact file as on an HFS+ volume, containing the icon data in the data fork
2. ._. – a special file (resource fork, perhaps?) which seems to tell OS X to use the icon

As illustrated previously, adding a custom icon to a FAT drive is exactly the same as on an HFS+ drive – create the icon resource and copy and paste it in the drive’s Info inspector. If we move these two files over to any other OS X-readable drive (including NTFS-formatted Boot Camp partitions), it will use the icon!

OS X can’t write to NTFS, so there are two ways to get these files onto an NTFS drive:

1. Make OS X write to NTFS by installing NTFS-3G
2. Copy the two files over in an OS like XP or Vista that can write to NTFS

[ad#vmware]The first method is simple, but not one I wanted to try. NTFS-3G is great – it’s a reverse-engineered open-source read/write driver for NTFS, and works on lots of platforms. But NTFS is finicky, and I’m not too keen on risking the integrity of the drive with an unsupported driver. If you want to use this method, though, customizing the icons is as simple as it is with FAT, once the driver is installed.

I used method 2 – relying on VMware Fusion to allow me to write the icon data to my NTFS drives and using a FAT-formatted flash drive as an intermediary between OS X and Vista. I created my icons, applied them to my flash drive, then booted up Vista in Fusion and copied the two files over in a DOS window. They’re hidden by default, but that shouldn’t slow you down.

Note that this only affects the icons in OS X – it will not allow you to customize the boot icons.

© sfoskett for Stephen Foskett, Pack Rat, 2008. | OS X Custom Drive Icons 2: Boot Camp and NTFS
This post was categorized as Apple, Virtual Storage. Each of my categories has its own feed if you'd like to filter out or focus on posts like this.