Disk Arbitrator 0.8

Descriptions for Disk Arbitrator 0.8

Name: Disk Arbitrator
Version: 0.8
Developer: Aaron Burghardt
Mac Platform: Intel
OS Version: OS X 10.5 or later

Includes: Pre-K’ed (The Shark)

Web Site: http://github.com/aburgh

Overview

Mac OS X forensic utility which manages file system mounting in support of forensic procedures

Disk Arbitrator is free and open source Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device.

Disk Arbitrator is essentially a user interface to the Disk Arbitration framework, which enables a program to participate in the management of block storage devices, to include controlling the automatic mounting of file systems.

When enabled, Disk Arbitrator will block the mounting of file systems to avoid mounting as read-write and violating the integrity of the evidence.

It is important to note that Disk Arbitrator is not a software write blocker—it does not change the state of currently attached devices nor does it affect newly attached devices to force a device to be read-only.

The user still must be careful to not accidently write to a disk with a command such as “dd”. Owing to this fact, a hardware or software write-blocker may still be desirable for the most sound procedure.

Disk Arbitrator compliments a write-blocker with additional useful features and eliminates the typical forensic recommendation to “disable disk arbitration.”

What’s new in Disk Arbitrator 0.8

• Release notes not available at the time of this post.