ATTENTION: The new home of the Digital Forensics Wiki is at https://forensicswiki.xyz/. Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn
Disabling Macintosh Disk Arbitration Daemon
- Start Terminal (in the Utilities folder).
cd /etc/mach_init.d ls
- Look for the file called diskarbitrationd.plist. If this file is in this directory, then disk arbitration is turned on. The disk arbitration file will attempt to mount any device it sees connected to the Mac, so one way you can stop disk arbitration from mounting the suspect's drive is by hiding this file. Simply renaming the file may not work.
To do this, store a backup copy of diskarbitrationd.plist under the root directory and then delete the original.
sudo cp diskarbitrationd.plist / ls /
Confirm that the copy is there.
- Remove the original file from the mach-int.d directory by typing:
sudo rm diskarbitrationd.plist.
You can restore disk arbitration when your done by typing:
sudo cp /diskarbitrationd.plist /etc/mach_init.d.
You can leave the copy in root for the next time, as it will have no effect on your system if it is left in that directory.