diff --git a/include/ntfs-3g/volume.h b/include/ntfs-3g/volume.h
index 9c8ab14c..b3f47bf9 100644
--- a/include/ntfs-3g/volume.h
+++ b/include/ntfs-3g/volume.h
@@ -58,6 +58,7 @@
 #endif
 
 #define MS_IGNORE_HIBERFILE   0x20000000
+#define MS_FORENSIC	      0x04000000 /* No modification during mount */
 
 /* Forward declaration */
 typedef struct _ntfs_volume ntfs_volume;
diff --git a/libntfs-3g/volume.c b/libntfs-3g/volume.c
index a30a33ad..21e68e9a 100644
--- a/libntfs-3g/volume.c
+++ b/libntfs-3g/volume.c
@@ -1184,7 +1184,7 @@ ntfs_volume *ntfs_device_mount(struct ntfs_device *dev, unsigned long flags)
 	 * Check for dirty logfile and hibernated Windows.
 	 * We care only about read-write mounts.
 	 */
-	if (!(flags & MS_RDONLY)) {
+	if (!(flags & (MS_RDONLY | MS_FORENSIC))) {
 		if (!(flags & MS_IGNORE_HIBERFILE) && 
 		    ntfs_volume_check_hiberfile(vol, 1) < 0)
 			goto error_exit;
@@ -1196,10 +1196,10 @@ ntfs_volume *ntfs_device_mount(struct ntfs_device *dev, unsigned long flags)
 			if (ntfs_logfile_reset(vol))
 				goto error_exit;
 		}
-	}
 		/* make $TXF_DATA resident if present on the root directory */
-	if (!NVolReadOnly(vol) && fix_txf_data(vol))
-		goto error_exit;
+		if (fix_txf_data(vol))
+			goto error_exit;
+	}
 
 	return vol;
 io_error_exit: