Disk images can be convenient ways to securely package and distribute files; however, there are a few issues that can crop up when using disk images. One of these is that depending on how the images are stored and used, they may automatically mount during normal system use.
When this happens it is likely because a file that is being stored on the disk image is being accessed. OS X will access a file by its full path, and if that path is to a disk image, then when opening the file path the system will try to open the image, which can be located on the main hard disk, on an external drive, or even on a network volume.
You can see this in action by creating a disk image with Disk Utility and copying a file to it. Then create an alias of that file and store it on the Desktop, and then unmount the disk image. If you then double-click the alias on the desktop, the system will mount the disk image containing the original file so it can be opened. If you delete the image so it is not available to the system, then opening the alias will result in an error.
If you are experiencing problems with a disk image randomly mounting, there are a couple of approaches you can take to fix the issue. The first is to check some possible system settings that may be responsible for targeting the disk image, and the second is to perform active scanning of file system usage to see when either the disk image or the volumes contained in it are accessed, and the third is to locate and remove the disk image.
Possible system settings
There are some instances where system settings can be configured to access files on disk images. One of these is the print system where custom printer drivers on disk images may not be copied to the system. In this case when printing the system may try to open the disk image containing the driver or resources used by the driver. To correct this, you can either open the printer's Queue (in the Print & Fax system preferences) and then select a new driver in the Driver tab, or reset the print system and reconfigure your printers.
Other settings that may access disk images include screensavers (especially those that use folders of objects such as photographs), the desktop background settings, and login items. Check the system's configuration of these items to ensure none of them target the contents of a disk image.
If you need more clues as to what files are being accessed on the disk image or what programs are accessing the image, some of the Terminal commands that are included with OS X may help. The first of these is the command "fs_usage," which will output all the instances any mounted file system is accessed, and when coupled with the "grep" command as a filter you can isolate all instances of when a specific volume is accessed, or when a specific file is accessed.
To do this, open the Terminal and enter the following command:
sudo fs_usage | grep FILTERSTRING
This command will run the fs_usage command, but will only display the output lines that contain "FILTERSTRING" so if you set the filter string to be the name of the disk image file, then the tool will output the times that image file is accessed, and will show what application is accessing the image file. If you set the filter string to be the name of the volume contained within the disk image, then the command will output when any file or folder on that volume is accessed
Keep in mind that the command will not display anything until fs_usage outputs a line that includes the filter string, so you may have to wait until the disk image is accessed before you get any results.
The command by default will output all file system access events, which can be a relatively large number for any given file. If you need to further filter the list, rerun the command with an additional "grep" statement such as the following:
sudo fs_usage | grep FILTERSTRING | grep SECONDFILTER
With the information from fs_usage, you can get the name of the file being accessed, the program accessing it, and the disk image on which the file resides. While the information might look a little cryptic, you can use it to better guide you to the settings that are responsible for opening the disk image.
Removing the disk image
Sometimes the easiest way to fix this type of problem is to just remove the disk image file that is being accessed. This may produce an error or two, but may also present you with an option to find the image or change the settings that point to it.
To locate the image and remove it, you can either use the information output from the fs_usage command, or when the volume is mounted right-click on it and choose "Get Info." Then look for "Disk Image:" in the "General" section of the information window and you should see the path to the image file. Go to this location and remove the image file, and the system will then no longer be able to access it.