OS X: Mount disks as read only or block automounting altogether #
Aaron Burghardt's open source Disk Arbitrator provides a simple GUI for changing OS X's automount behavior. Automounting can be disabled completely (especially handy for drive imaging / data recovery via ddrescue, etc) or mounts can be forced as read-only (for forensics, etc, though a hardware write-blocker is still recommended).
This little app replaces the following hacks I've been using to prevent automounting of USB / Firewire drives in OS X:
UPDATE 1: Aaron kindly replied to my email, pointing out that the "stop" command (since removed) isn't necessary in the fourth method above and that pausing/resuming diskarbitrationd with SIGSTOP and SIGCONT offers another option (though it too disables diskutil):
- biovizier's sudo chflags uchg /Volumes
- Ryan Kubasiak's backup and removal of /etc/mach_init.d/diskarbitrationd.plist for Tiger. This one was new to me, and Ryan kindly informs us that it is the only way to disable Disk Arbitration under 10.4.
- Charles Edge's launchctl stop 0×10abe0.diskarbitrationd for Leopard
- Matt's sudo launchctl unload /System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist for Snow Leopard. This method (and probably the one above) has the unfortunate side effect of disabling diskutil: "Unable to run because unable to use the DiskManagement framework. Common reasons include, but are not limited to, the DiskArbitration framework being unavailable due to being booted in single-user mode."
$ sudo launchctl list | grep diskarbitrationd
188 - com.apple.diskarbitrationd
$ sudo kill -SIGSTOP 188 # pauses diskarbitrationd, disabling automount
$ sudo kill -SIGCONT 188 # resumes diskarbitrationd, reenabling automount
UPDATE 2: More on disabling Disk Arbitration from Apple Examiner.
UPDATE 3: Mount USB drives as read-only in Windows
/mac | Aug 17, 2010
Subscribe or visit the archives