aburgh / Disk-Arbitrator

A Mac OS X forensic utility which manages file system mounting in support of forensic procedures.
BSD 3-Clause "New" or "Revised" License
662 stars 70 forks source link

Feature Request: rule-based system to auto-mount specific disks #2

Open aburgh opened 14 years ago

aburgh commented 14 years ago

Provide a means to configure a rule-set for the disks that Disk Arbitrator sees. For example: Always mount thumb-drive with serial number xxxxxxxx; always mount network drive xxxxxxxx; never mount CD/DVD volumes; etc.

halo commented 12 years ago

I like this one. I have a USB-Modem that comes with a read-only HFS containing the drivers. I sure don't want to see that Volume pop up anytime I insert the modem... Or is there a way to achieve what I want without using Disk-Arbitrator (on Lion)?

aburgh commented 12 years ago

That's an interesting use-case, but I think it would be better in a fork of Disk Arbitrator rather than added to the feature list. My reasoning is that Disk Arbitrator's target audience is forensic examiners, for whom it is essential to block all unknown disks so they don't accidentally mount an evidence disk. Your use-case is the opposite: you want to allow all disks except select individual disks. Since a forensic examiner is expecting it help protect against a mistake that could taint evidence, I would prefer to not add a feature that could alter that behavior, because it might get enabled accidentally.

That said, I a utility that blocks selected disks would be easy to create from Disk Arbitrator. To answer your question, I don't know of a way to do it even in Lion without writing a small application like this one.

halo commented 12 years ago

That clearly closes my "issue" :) Dirk Arbitrator would really be overkill, I think you're right. Thank you for your elaborate answer! Interesting. If I get bothered too much by my USB stick, I will go ahead and fork :)

DidierA commented 12 years ago

I think this feature is interesting, but for a different use case: I intend to use disk arbitrator so that SD cards or USB sticks are always mounted read-only, unless I want them to. However, it seems that when DA is active, my Time Machine backups do not work anymore: the network drive and disk image are mounted read-only (I guess). An exception rule-set would allow me to tell Disk-Arbitrator to let the TimeMachine drive mount read-write.

aburgh commented 12 years ago

Your timing is good. I am intending to update Disk Arbitrator and create two versions. One would be a forensic version that works like the current version, where all disks are blocked by default. A new feature would be the ability to "favorite" a disk so that it is allowed to mount when connected in the future. The second version would be a consumer version, which doesn't block anything by default, and the "favorite" feature would flag a disk to be blocked in the future.

I already have a test version of the above working, but in reading your suggestion, I realize it wouldn't be flexible enough for your use case. So, I'm contemplating a simple filter/actions system that would provide more flexibility. It's clear that you want to control whether a disk is read-only or read/write. But I'm not sure if you would want a filter, too, so that you didn't have to flag each SD card or USB stick individually. If the exceptions (favorites) described above had the ability to specify how to mount the disk, would that be enough?

Thanks,

Aaron

On Apr 6, 2012, at 6:59 PM, DidierA reply@reply.github.com wrote:

I think this feature is interesting, but for a different use case: I intend to use disk arbitrator so that SD cards or USB sticks are always mounted read-only, unless I want them to. However, it seems that when DA is active, my Time Machine backups do not work anymore: the network drive and disk image are mounted read-only (I guess). An exception rule-set would allow me to tell Disk-Arbitrator to let the TimeMachine drive mount read-write.


Reply to this email directly or view it on GitHub: https://github.com/aburgh/Disk-Arbitrator/issues/2#issuecomment-5004027

exalted commented 11 years ago

@aburgh any progress on this one please?

aburgh commented 11 years ago

No, sorry, it has fallen off my radar for the moment.

tristan-k commented 8 years ago

I'm searching for something like this as well. Can someone recommend an approach?