I use Crunchbang Linux on my own machines exclusively and hence, I format most of my external drives as ext4

However, I regularly transfer files to colleagues via an NTFS formatted 1TB drive. (they all use various versions of Windows)

I need a way to protect this drive from malware and user-error on these Windows machines.

Is there any way to make an NTFS drive read-only by default but writeable on my machine?

Alternatively, is there any alternative to NTFS that won't require installing additional software to everyone else's Windows machines?

Hi there,

yes, there is. Once the drive is connected to a Windows machine, you can adjust the NTFS access rights so that nobody has write permission any more (except Administrator, maybe). There's the convenient side effect that the Windows boxes won't keep creating that silly "System Volume Information" directory each time the drive is connected.

The Linux NTFS driver doesn't care about NTFS access rights, so you can always write to the drive from Linux.

The downside of this procedure is that your colleagues can't give any files back to you this way.

Probably not. The only file systems Windows supports natively is the FAT family and NTFS. Anything else, for instance ext2/3, will require an extra driver.

[X] Doc CPU

Here's a convenient script for setting the ro flag by volume label: https://gist.github.com/mmdemirbas/5229315


Then ensuring all users are properly educated about safe browsing / networking habits, logging, auditing and adjusting unwanted behaviour, denying Administrator privileges, making regular backups, filtering network access and deploying a good antivirus solution should be the first measures to take.
Setting a NTFS volumes readonly flag is like combating symptoms and not addressing the real cause(s).

Agreed. Unfortunately, you're preaching to the choir. :P
This is mostly my colleague's personal machines and I've long since given up explaining the basics to them.
Here in South Africa, most malware is distributed via USB flash-drives as most people don't have Internet. (except 3G, which is expensive)
For the same reason, most home computers never get updates.


Anyway, thanks for the tips.

Ah, I see the mess you're in... In that case I agree in whatever constitutes good defense.