0

I would like to check the contents of a USB stick drive from a not-quite trusted source (my sister): is there a safe way to do this in OSX 10.9.5 or 10.10.1?

1

What I typically do is mount the USB drive in an isolated virtual machine. But this requires you have a hypervisor installed and a guest operation system configured, etc. This works because I can snapshot the VM state as well as isolate at the network level. But it's too complicated to explain here.

Probably the easiest way to do this is to mount the drive as read-only. You can do this by using diskutil from Terminal.

  1. Open /Applications/Utilities/Terminal.
  2. Insert the drive into a USB port.
  3. Run diskutil list from Terminal and note the disk number for your USB drive. Here's what my output looked like

$ diskutil list /dev/disk0 #: TYPE NAME SIZE IDENTIFIER 0: GUID_partition_scheme *251.0 GB disk0 1: EFI EFI 209.7 MB disk0s1 2: Apple_CoreStorage 250.1 GB disk0s2 3: Apple_Boot Recovery HD 650.0 MB disk0s3 /dev/disk1 #: TYPE NAME SIZE IDENTIFIER 0: Apple_HFS Macintosh HD *249.8 GB disk1 Logical Volume on disk0s2 5F6A08FD-AD5D-4C63-9DF2-8C1DE409F264 Unencrypted /dev/disk2 #: TYPE NAME SIZE IDENTIFIER 0: GUID_partition_scheme *32.7 GB disk2 1: EFI EFI 209.7 MB disk2s1 2: Apple_HFS TomThumb 32.4 GB disk2s2

So my USB drive is disk2.

  1. Eject the disk by running diskutil unmountDisk /dev/diskX (which would be "disk2" for me)
  2. Remount disk in read only mode by running diskutil mountDisk readOnly /dev/diskX
  3. Use Finder or Terminal to examine the disk.

Note that if you eject the drive, you'd need to run this sequence again to have it mount as read only. There are other apps that automate mounting disks as read only but the command line is the only real UI for any OS! ;-) #opinion

2
  • Depending on the level of potential malware, wouldn't step # 2 give the thumb drive access to the filesystem? – Patrick McMahon Jan 29 '15 at 19:06
  • Yes, that's possible but using VM network isolation will limit exposure in almost any case. – SaxDaddy Feb 2 '15 at 22:00
0

That's a good idea and a lot of malware depends on being able to write to where it is running from but it is not foolproof and if the O/S can read the drive then stuff can get off the drive.

For the really paranoid I would be tempted to download and burn a LiveCD (Ubuntu or the like) that will boot your Mac. Boot it from the LiveCD and then examine the contents.

You can then remove any potentially harmful Macintosh executables, Javascript or Flash exploits or infected files of other kinds.

Though it will require a bit of technical savvy to do all of that.

0

One option is to reboot your Mac to a Linux installation CD/DVD.

You can unmount your local hard disk once the Linux desktop loads.

You can then plug in the thumb drive and be isolated from your installation of Mac OS X as well as your local hard disk.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .