1

For forensic imaging of drives and/or segments with a native Mac application, I'm booting from external device (usb, hdd, etc.) into BaseSystem. I want to keep the internal drives and/or segments unmounted during the boot process. Later will disable disk arbitration, mount these drives/segments and image them. Since the drives should be kept unmounted, there is no way of knowing drive/segment volume names and/or UUID.

I've created a deamon (System/Library/LaunchDeamons) for mount blocking (on external boot device), but it only blocks newly attached devices, not internal ones.

Also, I've also tried disabling "diskarbitrationd" daemon (desperately, on external boot device), but not worked.

Note: I've created boot image from BaseSystem.dmg of Sierra (10.12.1), and modified the contents.

ANSerpen
  • 127

1 Answers1

-4

Nobody even commented. There may be a solution from a clue keyword autodiskmount

ANSerpen
  • 127
  • 1
    I guess you were the first person to raise this. For the benefit of the second, third etc - what was the solution? – John N Dec 17 '16 at 08:47
  • I assume that you are referring to adding an entry to /etc/fstab to disable auto-mounting of specific partitions. Would be great if you could add a sample. – nohillside Dec 17 '16 at 10:39
  • http://apple.stackexchange.com/questions/150610/how-to-prevent-all-usb-mass-storages-from-mounting-at-boot might give some clues – nohillside Dec 17 '16 at 10:40
  • @patrix, that's not the solution. We don't know the drive/segment volume names and/or UUIDs beforehand. – ANSerpen Dec 17 '16 at 15:33
  • @John, of course, but those two negative vote should go first. Because I spent too much time to figure it out. If the people given those votes were following this question, why nobody voted for the question? Come here and vote for unuseful...! – ANSerpen Dec 17 '16 at 15:39
  • Three now. Glad you figured it out. – John N Dec 17 '16 at 15:54
  • The only way to get upvotes is by providing helpful answers (or editing an answer to make it more helpful). – nohillside Dec 17 '16 at 16:01