I would like to check the contents of a USB stick drive from a not-quite trusted source (my sister): is there a safe way to do this in OSX 10.9.5 or 10.10.1?
What I typically do is mount the USB drive in an isolated virtual machine. But this requires you have a hypervisor installed and a guest operation system configured, etc. This works because I can snapshot the VM state as well as isolate at the network level. But it's too complicated to explain here.
Probably the easiest way to do this is to mount the drive as read-only. You can do this by using
diskutil from Terminal.
- Open /Applications/Utilities/Terminal.
- Insert the drive into a USB port.
diskutil listfrom Terminal and note the disk number for your USB drive. Here's what my output looked like
$ diskutil list /dev/disk0 #: TYPE NAME SIZE IDENTIFIER 0: GUID_partition_scheme *251.0 GB disk0 1: EFI EFI 209.7 MB disk0s1 2: Apple_CoreStorage 250.1 GB disk0s2 3: Apple_Boot Recovery HD 650.0 MB disk0s3 /dev/disk1 #: TYPE NAME SIZE IDENTIFIER 0: Apple_HFS Macintosh HD *249.8 GB disk1 Logical Volume on disk0s2 5F6A08FD-AD5D-4C63-9DF2-8C1DE409F264 Unencrypted /dev/disk2 #: TYPE NAME SIZE IDENTIFIER 0: GUID_partition_scheme *32.7 GB disk2 1: EFI EFI 209.7 MB disk2s1 2: Apple_HFS TomThumb 32.4 GB disk2s2
So my USB drive is
- Eject the disk by running
diskutil unmountDisk /dev/diskX(which would be "disk2" for me)
- Remount disk in read only mode by running
diskutil mountDisk readOnly /dev/diskX
- Use Finder or Terminal to examine the disk.
Note that if you eject the drive, you'd need to run this sequence again to have it mount as read only. There are other apps that automate mounting disks as read only but the command line is the only real UI for any OS! ;-) #opinion
That's a good idea and a lot of malware depends on being able to write to where it is running from but it is not foolproof and if the O/S can read the drive then stuff can get off the drive.
For the really paranoid I would be tempted to download and burn a LiveCD (Ubuntu or the like) that will boot your Mac. Boot it from the LiveCD and then examine the contents.
Though it will require a bit of technical savvy to do all of that.