Disk Arbitrator hooks into macOS's Disk Arbitration framework to intercept every mounted storage device and force it read-only before the system can write anything to the evidence media — critical for preserving evidence integrity on Mac-based forensic workstations.