1

I'm trying to capture a forensic image of a USB stick using Linux dd on my Macbook. I'm having trouble turning on write blocking to the USB stick before taking the image. In Windows you use a registry tweak to prevent writing on the USB stick- how do you do this on Mac (without spending money for a DLP solution)?

Is this still valid to achieve that effect on MacOS, or did an update nullify it: sudo kextunload /System/Library/Extensions/IOUSBMassStorageClass.kext

1 Answer 1

1

The command you quote has never been able to give the effect you want. That command disables USB mass storage class devices entirely - i.e. you wouldn't be able to read the device at all (nor would you be able to write to it). It wouldn't be useful when you want to capture a forensic image.

Instead a way to go would be to stop the standard macOS automounter from mounting your USB stick as read/write. Then you could either mount it as read-only, or simply not mount it at all. Then you can take your forensic image.

A simple way to do that is to install Disk Arbitrator, which is a freely available utility. Ensure that the icon indicates either green (block mounts entirely) or orange (mounts as read-only) before proceeding to plugging in the USB stick.

If you prefer a command line way of achieving something similar, you could disable auto mounting by this command:

sudo launchctl unload /System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist

Remember to test that this works with a test USB stick before using the real stick you want to create an image from.

You should be aware that this method is not "fool-proof". I.e. it will stop the system from auto-mounting the drive and contaminating it with Spotlight indices or similar. However, it does protect the USB stick from you doing stupid things. I.e. if you decide to use dd to write to the drive instead of reading from it, you will be able to do just that.

1
  • Thank you so much! Your explanation is great.
    – Sydney E
    Oct 3, 2022 at 17:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .