I to need this functionallity also. I am currentlly re-mastering a forensic tool kit out of KNOPPIX. I should be able to change this script and get knoppix not to mount swap on boot right? Also, for those of you using KNOPPIX for forensic analysis of machines, I have done a validation study and have found mounting EXT3 and reiserfs partitions read-only changes the state of the drive. I am publishing my paper on my website later next week. Now the good news is that it seems to be the Kernel and not KNOPPIX. I have repeated these test with other distros and have come up with the same results. Now I do know that mounting read-only will not let you write to the drive and I believe it is probably a journaling issue since EXT3 and reiser are newer journaling file systems. The tests were conducted on NTFS, FAT32, ETX2, EXT3, and reiserfs. FAT32, NTFS and EXT2 mounts read-only faired ok and did not change the state of the drive. Although it may just be a journaling issue, it may not fly when it comes to law enforcement evidnce issues. Now those in the private sector it may be a different story. Oh well, hope my white paper explains it well. I lost my inital test results and had to do it all over again so one more week till it gets on to my publications section of my website....


Thanks,
Ernie Baca
www.linux-forensics.com