Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Why are hard drives mounted by default in Windows OS, while they aren't in Linux OS? Is that a security issue?

If your computer was hacked, can unmounted drives be considered clean?

share|improve this question
2  
I think this becomes a battle between security & usability. If the HDDs are not mounted, they're useless to both the attacker and the users. By leaving them un-mounted, you're making it difficult for the attacker to access them while also effectively DoS-ing yourself. – Iszi Jan 12 '12 at 6:00

1 Answer

up vote 9 down vote accepted

Why are hard drives mounted by default in Windows OS, while they aren't in Linux OS?

Typical user-oriented GNU/Linux distros have automounters on by default.

Is that a security issue?

More like a usability issue.

If your computer was hacked, can unmounted drives be considered clean?

No, because the attacker could mount them, do his dirty stuff and unmount them again, and wipe the logs. Only careful inspection of FS metadata will reveal when it was mounted (provided that the attacker didn't mess with it, which you likely won't be able to prove).

share|improve this answer
Does your talk "Mischa Arefiev" contrary to "lszi" comment above !!. Can you explain little more please. Then you mean at the first answer that drives can be mounted too like in Windows by default, don't you? – wisdom Jan 12 '12 at 10:37
2  
@wisdom - this is the same as Iszi's comment. To be used, a drive must first be mounted. In windows and user oriented linuxes automount is the norm. – Rory Alsop♦ Jan 12 '12 at 11:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.