How To Write To Windows NTFS Drives In Mac OS X 10.6 “Snow Leopard”

One of the daily hassles of using Apple Macintosh computers is the incompatibilities that arise with the broad Microsoft Windows world. Individual files often require conversion, but what about whole disks? Apple has long supported the universal and simplistic FAT filesystem, and added read-only support for NTFS back in 2003 in OS X 10.3 “Panther”. Third-party software like Paragon’s NTFS or the free NTFS-3G driver enabled read/write support, but a native solution was more desirable. Although 10.6 “Snow Leopard” includes NTFS write support, it is disabled by default. In this post, I’ll discuss methods for activating this native NTFS write support, as well as the pros and cons of doing so!

Introducing NTFS

A filesystem is the basic scheme for organizing data on a hard disk drive. The common FAT filesystem, supported by just about every operating system, is just too basic for modern operating systems. Microsoft introduced the advanced NTFS filesystem with their Windows NT operating system in 1993. Borrowing from OS/2’s HPFS and VMS’ Files-11, NTFS is a journalling filesystem with many features, including POSIX links, alternate data streams, sparse files, compression, and encryption.

Although just about everything Microsoft produces is maligned by UNIX and Mac geeks, this hatred is unwarranted in the case of the many storage advances coming out of Redmond. Microsoft may be fairly criticized for producing expensive, proprietary systems, but they have dome some amazing things with disks, and NTFS is arguably one of the most advanced filesystems in wide usage. Much of this credit goes to Windows NT architect Dave Cutler, who also led development of DEC VMS, the RISC concepts that became Alpha, and Microsoft’s Azure cloud platform.

Although every version of Windows supports evolutions of the old FAT filesystem, modern iterations increasingly require NTFS. Windows XP allowed either FAT32 or NTFS for booting; Windows Vista could be forced to boot from FAT32; Windows 7 requires NTFS. Therefore, most PC hard disk drives, including external USB drives, now come formatted with NTFS by default.

NTFS on Mac OS X

This leads to issues for Mac users, especially when they dual-boot with Boot Camp or buy external hard disk drives. As mentioned, all versions of Mac OS X since 10.3 “Panther” have included read-only NTFS support, but those wanting full access had two options:

1. Paragon Software’s NTFS for Mac OS X is a full and supported read/write solution. Although available for purchase separately, many hard disk drives like the Seagate GoFlex now include a free copy of Paragon NTFS.
2. The open source NTFS-3G driver has also been ported to Mac OS X, allowing read/write support for free.

Mac OS X 10.6 “Snow Leopard” adds a third alternative: Native read/write support for NTFS. But it’s not as simple as that. Although early betas enabled read/write support by default, it was limited once again to read-only in the final releases.

It is possible and even simple) to enable read/write support with the native Snow Leopard drivers, but this is definitely an “at your own risk” proposition. Users have reported kernel panics when using these methods, and although I have not heard of data corruption, it is possible as well.

The Manual Method: mount_ntfs

Making disks available is called “mounting” in UNIX geek-speak, and mount commands in modern operating systems are like ogres: They have many layers. Plug in a drive, and Mac OS X makes it available for you using a layer cake of commands, but the bottom-most command is “mount”. This simple command-line utility takes a few arguments and attaches a raw disk device to a point in the unified filesystem tree.

When presented an NTFS drive, Mac OS X calls a utility called mount_ntfs that resides in the /sbin directory, and we can call it, too. Although OS X always tells mount_ntfs to mount NTFS drives read-only, we can tell it to enable writing as well by using the “-o rw” flag.

There’s just one problem: Where should we connect the NTFS file system? Mac OS X automatically creates a new directory (called a “mount point” in UNIX-speak) in /Volumes with the name of the filesystem. For example, the GoFlex drive I bought yesterday mounts as “/Volumes/FreeAgent GoFlex Drive” by default. But mount_ntfs won’t create this mount point, so we have to do it.

Here are the steps to mount an NTFS drive read/write from the command line:

1. Plug in the drive and let Mac OS X mount it read-only.
2. Look in Finder to see the name of the drive. For example, my drive mounts with the name “FreeAgent GoFlex Drive” and this is what shows up on the desktop and in Frinder under “Devices”.
3. Open the Terminal application to get command-line access. We’ll use “sudo” which executes commands as the administrator instead of a regular user.
4. Type the following command in Terminal to get necessary information about the drive. Use the drive name you see in Finder in place of “drive name”, and make sure to use quotation marks around it since Terminal treats un-quoted spaces as separators rather than part of the name.

   diskutil info "/Volumes/drive name"

5. Record the “Device Node” entry, which will look something like “/dev/disk4s1”. This is where the raw partition is mapped by the disk subsystem, and where the filesystem driver will read its data.



6. Eject the drive, using option-click in Finder or with the hdiutil command in Terminal:

   hdiutil eject "/Volumes/drive name"

7. Now you must create the mount point again. Type the following:

   sudo mkdir "/Volumes/drive name"

8. Finally, use mount_ntfs to mount the drive read/write using the following command. Use the node name you spotted above and the mount point you just created:

   sudo mount_ntfs -o rw /dev/disk?s? "/Volumes/drive name"

9. When you’re done, you can use the Finder, the hdiutil command, or just about anything else to eject the drive. Make sure your mount point is deleted as well!

This method is great for occasional NTFS use, which is frankly all Mac users should need. If you intend to use a drive frequently, I highly recommend reformatting it with the native HFS+ filesystem since it will be fully-supported by the operating system.

The Per-Drive Method

Let’s say you have an NTFS drive you frequently need to mount read/write and find the above method too much of a hassle. Maybe it’s your Boot Camp drive, or perhaps it’s a USB hard disk drive you share with a Windows-using colleague. It is possible to tell Mac OS X to always mount a given NTFS drive read/write using its native driver using the following commands. However, I recommend investing in the Paragon driver for this use case, since it’s fully-supported!

Like all UNIX systems, Mac OS X uses a configuration file to determine what it should do with certain drives. This file, called “fstab” and located in “/etc”, is not present by default but will override the “read-only” flag on a per-drive basis if found. This allows a drive to always be mounted read/write without any hassle.

1. Get the drive name as in step 2 above.
2. Open Terminal and type the following command to edit the /etc/fstab file:

   sudo nano /etc/fstab



3. “Nano” is a command-line editing program. Add the following line to the file (and don’t forget the quotes around the drive name if it contains spaces!)

   LABEL="drive name" none ntfs rw

4. Now type control-x to save and exit, type y for yes, and hit enter.
5. After a reboot, Mac OS X should automatically mount any drive with that label as read/write

Note that this can also be done using the NTFS UUID of the drive, but this isn’t present on every drive to LABEL works better. Also, some have reported needing multiple reboots to make it work. I have no idea why.

The Permanent Universal Method

It is also possible to permanently modify how Mac OS X calls the mount_ntfs command to always mount every NTFS drive in read/write mode. Again, I will point out that this isn’t necessarily a great idea since Apple doesn’t support using the driver in this way. But here it is!

1. Open Terminal. We won’t need the drive name or Node Name since this applies to every NTFS drive.
2. Rename the mount_ntfs command to something else by typing the following:

   sudo mv /sbin/mount_ntfs /sbin/mount_ntfs_orig

3. Create a shell script called mount_ntfs using the Nano editor:

   sudo nano /sbin/mount_ntfs

4. This script will simply call mount_ntfs with the “-o rw” flag every time it’s used. Type the following in Nano:

   #!/bin/sh
   /sbin/mount_ntfs_orig -o rw "$@"

5. Type control-x to save and exit, type y for yes, and hit enter.
6. Now we’ll fix the permissions on this new file so it’s owned by root and group wheel:

   sudo chown root:wheel /sbin/mount_ntfs

7. Finally, we make the shell script executable:

   sudo chmod 755 /sbin/mount_ntfs

8. Now every time OS X encounters an NTFS drive, it will mount it read/write by calling this script rather than the “mount_ntfs” executable it thinks it’s using.

Note that future OS updates might “break” this method by replacing the /sbin/mount_ntfs command, or it could cause other issues. But it works for now and doesn’t even require a reboot.

Stephen’s Stance

I’m hesitant to recommend that casual Mac users employ any of these methods to access NTFS drives. Each requires superuser access and careful typing. You can easily mess up your system this way, and unsupported uses of the NTFS driver might result in data loss.

If you aren’t comfortable with this kind of mucking-about or intend to frequently write to NTFS drives, I highly suggest installing NTFS-3G or Paragon’s NTFS driver. In fact, the best method is simply to go buy a Seagate GoFlex drive and use the Paragon driver that comes with it!

But hackers and geeks like me want to know how to do this. This is why I decided to document it here.