Is the USB device mounted before you click on its name in the file manager?

Try running mount in a terminal after having plugged the USB device.

It should not appear. But if you click on the device in the file manager, GNOME will mount it for you (how else do you want GNOME to show you its content?). In any case, I would not use the GNOME file manager for forensic purpose...

You are correct. It is not automounting unless I click on it in the file manager. It is not mounted before clicking the volume name in file manager, but once I do it does. I just noticed that if I hover over the volume name it says "Mount and open "volumename"".

Therefore, this looks like user error.

With all that said, I personally am not a fan of this approach. I would prefer some sort of app that displays the available devices and that allows me to toggle/change R/RW settings and handling mounting or mount via command line. Just seems way too easy to mistakenly click on the device while just trying to navigate around and accidently mount the device with one click.

If you are taking an image, you likely will have multiple drives attached, so I think it could be really easy for someone to make this mistake in the field if they were not aware that simply clicking on the name would automount the device. In the end, this is your product, so you can do what you like, and you do have your disclaimer "nothing should happen to any media without direct user action. Anything that you do as a user is on you."

In the end, people should be testing their process (like I did) and figure out these potential issues before it happens in the field. However, my two cents, a separate mounting app (or force any mounting via command line) would provide a little more control.

Thanks again for providing this to the community and for the follow up on this.

I appreciate your comments and I agree with your feelings. We setup Kali/GNOME to not auto-mount the medias but in the end we don't have any recommended workflow/toolset for forensic purpose... so it's up to the user to select the most appropriate tools and nautilus would certainly not be among the selected tools as it's easy to make a mistake like this one.