How can I check USB drive contents safely? I would like to check the contents of a USB stick drive from a not-quite trusted source (my sister): is there a safe way to do this in OSX 10.9.5 or 10.10.1?
What I typically do is mount the USB drive in an isolated virtual machine. But this requires you have a hypervisor installed and a guest operation system configured, etc. This works because I can snapshot the VM state as well as isolate at the network level. But it's too complicated to explain here.

Probably the easiest way to do this is to mount the drive as read-only. You can do this by using diskutil from Terminal.


Open /Applications/Utilities/Terminal.
Insert the drive into a USB port.
Run diskutil list from Terminal and note the disk number for your USB drive. Here's what my output looked like



  $ diskutil list
  /dev/disk0
    #:                       TYPE NAME                    SIZE       IDENTIFIER
    0:      GUID_partition_scheme                        *251.0 GB   disk0
    1:                        EFI EFI                     209.7 MB   disk0s1
    2:          Apple_CoreStorage                         250.1 GB   disk0s2
    3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
  /dev/disk1
    #:                       TYPE NAME                    SIZE       IDENTIFIER
    0:                  Apple_HFS Macintosh HD           *249.8 GB   disk1
                                  Logical Volume on disk0s2
                                  5F6A08FD-AD5D-4C63-9DF2-8C1DE409F264
                                  Unencrypted
  /dev/disk2
    #:                       TYPE NAME                    SIZE       IDENTIFIER
    0:      GUID_partition_scheme                        *32.7 GB    disk2
    1:                        EFI EFI                     209.7 MB   disk2s1
    2:                  Apple_HFS TomThumb                32.4 GB    disk2s2


So my USB drive is disk2.


Eject the disk by running diskutil unmountDisk /dev/diskX (which would be "disk2" for me)
Remount disk in read only mode by running diskutil mountDisk readOnly /dev/diskX
Use Finder or Terminal to examine the disk.


Note that if you eject the drive, you'd need to run this sequence again to have it mount as read only. There are other apps that automate mounting disks as read only but the command line is the only real UI for any OS! ;-) #opinion