Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Why are hard drives mounted by default in Windows OS, while they aren't in Linux OS? Is that a security issue?

If your computer was hacked, can unmounted drives be considered clean?

share
2  
I think this becomes a battle between security & usability. If the HDDs are not mounted, they're useless to both the attacker and the users. By leaving them un-mounted, you're making it difficult for the attacker to access them while also effectively DoS-ing yourself. –  Iszi Jan 12 '12 at 6:00

1 Answer 1

up vote 9 down vote accepted

Why are hard drives mounted by default in Windows OS, while they aren't in Linux OS?

Typical user-oriented GNU/Linux distros have automounters on by default.

Is that a security issue?

More like a usability issue.

If your computer was hacked, can unmounted drives be considered clean?

No, because the attacker could mount them, do his dirty stuff and unmount them again, and wipe the logs. Only careful inspection of FS metadata will reveal when it was mounted (provided that the attacker didn't mess with it, which you likely won't be able to prove).

share
    
Does your talk "Mischa Arefiev" contrary to "lszi" comment above !!. Can you explain little more please. Then you mean at the first answer that drives can be mounted too like in Windows by default, don't you? –  wisdom Jan 12 '12 at 10:37
2  
@wisdom - this is the same as Iszi's comment. To be used, a drive must first be mounted. In windows and user oriented linuxes automount is the norm. –  Rory Alsop Jan 12 '12 at 11:21

This site is currently not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .