Disk Arbitrator

Disk Arbitrator is a cool, free, and open-source tool for Mac OS X. It’s designed to help you follow the right forensic steps when you’re imaging a disk device. Pretty neat, right?

What Does Disk Arbitrator Do?

This software is basically a user-friendly interface for the Disk Arbitration framework. This means it helps manage block storage devices and control how file systems are automatically mounted.

Avoiding Mistakes with Mounting

When you turn on Disk Arbitrator, it stops file systems from being mounted automatically. This is super important because if a disk mounts as read-write, it can mess up the evidence you’re trying to collect!

Important Notes about Disk Arbitrator

Now, here’s something crucial: Disk Arbitrator isn’t a software write blocker. It won’t change the state of devices that are currently connected or force new ones to be read-only. So, you still have to be careful not to accidentally write to a disk using commands like "dd." Yikes!

Add Some Extra Protection

This is why having a hardware or software write-blocker might still be a smart move for really solid procedures. Disk Arbitrator works well alongside these blockers by offering some great extra features.

No More Disabling Disk Arbitration!

The best part? Using Disk Arbitrator means you can skip the usual recommendation of disabling disk arbitration while ensuring everything goes smoothly during your forensic work.

If you're ready to get started with Disk Arbitrator, make sure you're following all the right steps for your forensic projects!