1

For forensic imaging of drives and/or segments with a native Mac application, I'm booting from external device (usb, hdd, etc.) into BaseSystem. I want to keep the internal drives and/or segments unmounted during the boot process. Later will disable disk arbitration, mount these drives/segments and image them. Since the drives should be kept unmounted, there is no way of knowing drive/segment volume names and/or UUID.

I've created a deamon (System/Library/LaunchDeamons) for mount blocking (on external boot device), but it only blocks newly attached devices, not internal ones.

Also, I've also tried disabling "diskarbitrationd" daemon (desperately, on external boot device), but not worked.

Note: I've created boot image from BaseSystem.dmg of Sierra (10.12.1), and modified the contents.

0
-4

Nobody even commented. There may be a solution from a clue keyword autodiskmount

7
  • 1
    I guess you were the first person to raise this. For the benefit of the second, third etc - what was the solution?
    – John N
    Dec 17 '16 at 8:47
  • I assume that you are referring to adding an entry to /etc/fstab to disable auto-mounting of specific partitions. Would be great if you could add a sample.
    – nohillside
    Dec 17 '16 at 10:39
  • apple.stackexchange.com/questions/150610/… might give some clues
    – nohillside
    Dec 17 '16 at 10:40
  • @patrix, that's not the solution. We don't know the drive/segment volume names and/or UUIDs beforehand.
    – ANSerpen
    Dec 17 '16 at 15:33
  • @John, of course, but those two negative vote should go first. Because I spent too much time to figure it out. If the people given those votes were following this question, why nobody voted for the question? Come here and vote for unuseful...!
    – ANSerpen
    Dec 17 '16 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .