macoscomputer-forensicsautomountdiskarbitration

Is there a way to keep internal drive segments unmounted while booting from external device


For forensic imaging of drives and/or segments with a native Mac application, I'm booting from external device (usb, hdd, etc.) into BaseSystem. I want to keep the internal drives and/or segments unmounted during the boot process (there is no way of knowing drive/segment volume names and/or UUID before booting). Later will disable disk arbitration, mount these drives/segments and image them.

I've created a deamon (System/Library/LaunchDeamons) for mount blocking (on external boot device), but it only blocks newly attached devices, not internal ones.

Note 1: I've created boot image from BaseSystem.dmg of Sierra (10.12.1), and modified the contents.

Note 2: Since there is no way of knowing drive/segment volume names and/or UUID before booting, it is not possible to use fstab.

I need a direction to follow, any comment may help. Thanks.


Solution

  • Nobody, even commented. I found the solution from a clue keyword from a friend: autodiskmount