There seems to be at least 3 possible APIs to detect the mounting of a volume on macOS:
- Endpoint Security APIs through the NOTIFY_MOUNT event.
- Disk Arbitration
- NSWorkspace notifications.
If we omit NSWorkspace for different reasons (headless, background context), this leaves only 2 choices.
From what I'm reading and understanding, the NOTIFY_MOUNT event is just telling that a volume is being mounted. It does not guarantee that the volume is mounted at the time of the event.
So this seems to leave only Disk Arbitration.
Since the Disk Arbitration API has been there for a long time, the question is:
Is there a more modern API than Disk Arbitration to know when a volume has been mounted?