forensic cheatcode and remounting.

Do you know if when booting with "forensic" option (so, read-only mounting my pendrive) is possible to remount as read-write later?. If I understand it well, if my pendrive is /dev/sdb1 and /dev/sdb is mounted as read-only using "forensic", then it should be impossible to receive an attack from outside umounting my pendrive and remounting later as read and write to change my knoppix. If /dev/sdb is already working with knoppix, how can it be umounted and remounted?, I think it's not possible and so I can be safe. Am I right?. Thank you guys :)