Forensic Friday - Disabling Automount in Ubuntu Linux

In forensics one of the most important things we need to assure is that we are not inadvertently writing data to suspect drives before imaging them. In this short, we look at how we can disable auto-mounting so unintentional disk writes are not written to the suspect disk.

Commands:
sudo systemctl stop udisks2.service (stop the service)
sudo systemctl start udisks2.service (start the service again)

sudo fdisk -l (list the disks without any filtering)
sudo fdisk -l | grep -i "nvme" (list all nvme drives in Linux)
sudo fdisk -l | grep -i "mmc" (list all sd/mmc cards)



!!!REFERENCE PURPOSES ONLY DO NOT USE THESE IN/DURING AN ACTIVE FORENSICS!!!:
sudo mount /dev/block /folder/suspect (mounts a device "block" to a folder called suspect)
sudo eject /folder/suspect (ejects a mounted disk from the system)


#forensics #computerforensics #diskforensics  #digitalforensics #dfir

• #science_technology
• #computer_forensics
• #linux_automount
• #automount
• #dfir
• #forensic_disk_analysis
• #forensic_acquisition