Investigate logging disk image mounts

[russellhancox]

Knowing which disk image an executable came from can be very useful when tracking down possible malware. Knowing where that DMG was downloaded from is even better.

Possible method for this:

1. Use DiskArbitration to monitor for new mounts
2. Run hdiutil info -plist each time a mount happens
3. Retrieve the record matching the new mount, get image-path
4. Get quarantine data (if possible) and hash of image-path

[russellhancox]

This may no longer be necessary, the recent fixes to quarantine data collection mean that binaries run from or copied from a disk image still reference the disk image download URL.

[russellhancox]

Even better, it's possible to get disk image paths from IOKit. This should be included in 0.9.10.