ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between pages "Internet Explorer" and "Xmount"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(External Links)
 
Line 1: Line 1:
{{Expand}}
+
{{Infobox_Software |
 +
  name = xmount |
 +
  maintainer = [[Daniel Gillen]] |
 +
  os = [[Linux]], [[Mac OS X]] |
 +
  genre = [[Image mounting]] |
 +
  license = {{GPL}} |
 +
  website = [https://www.pinguin.lu/index.php www.pinguin.lu] |
 +
}}
  
Microsoft Internet Explorer (MSIE) is the default [[Web Browser]] included with [[Microsoft Windows]].
+
Description taken from xmount project site on Pinguin's HQ:
  
== MSIE 10 ==
+
xmount allows you to convert on-the-fly between multiple input and output harddisk image types. xmount creates a virtual file system using FUSE (Filesystem in Userspace) that contains a virtual representation of the input image.
  
<pre>
+
The virtual representation can be in:
C:\Users\%USER%\AppData\Local\Microsoft\Windows\WebCache\
+
* [[Raw Image Format|raw DD]]
</pre>
+
* DMG
 +
* [[Virtual Hard Disk (VHD)|VHD]]
 +
* [[Virtual Disk Image (VDI)|VirtualBox's virtual disk file format]]
 +
* [[VMWare Virtual Disk Format (VMDK)|VmWare's VMDK file format]]
  
== See Also ==
+
Input images can be:
 +
* [[Raw Image Format|raw DD]]
 +
* [[Encase image file format|EWF (Expert Witness Compression Format)]]
 +
* [[AFF|AFF (Advanced Forensic Format)]]
  
* [[Internet Explorer History File Format]], applies to MSIE 4, 5 to 9
+
In addition, xmount also supports virtual write access to the output files that is redirected to a cache file. This makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox, VmWare or alike.
 +
 
 +
== See Also ==
 +
* [[Disk Images]]
  
 
== External Links ==
 
== External Links ==
* [http://www.microsoft.com/en-us/download/details.aspx?id=11575 Windows Virtual PC VHDs for testing websites with different Internet Explorer versions], by [[Microsoft]]
 
* [http://kb.digital-detective.co.uk/display/NetAnalysis1/Internet+Explorer+Cache Internet Explorer Cache]
 
* [http://support.microsoft.com/kb/182569 Internet Explorer security zones registry entries for advanced users], by [[Microsoft]]
 
* [http://www.swiftforensics.com/2011/09/internet-explorer-recoverystore-aka.html Internet Explorer RecoveryStore (aka Travelog) as evidence of Internet Browsing activity], by [[Yogesh Khatri]], September 29, 2011
 
  
[[Category:Applications]]
+
* [https://www.pinguin.lu/index.php Pinguin's HQ]
[[Category:Web Browsers]]
+
* [http://files.pinguin.lu/projects/HOWTO-BootingAcquiredWindows.pdf HOWTO: Booting an acquired hard disk image containing a Windows installation using xmount and OpenGates].
 +
* [http://linuxsleuthing.blogspot.ch/2013/03/xmount-when-changing-evidence-isnt-so.html Xmount: When "Changing" the Evidence isn't so Bad], by [[John Lehr]], March 21, 2013

Revision as of 06:47, 27 March 2013

xmount
Maintainer: Daniel Gillen
OS: Linux, Mac OS X
Genre: Image mounting
License: GPL
Website: www.pinguin.lu

Description taken from xmount project site on Pinguin's HQ:

xmount allows you to convert on-the-fly between multiple input and output harddisk image types. xmount creates a virtual file system using FUSE (Filesystem in Userspace) that contains a virtual representation of the input image.

The virtual representation can be in:

Input images can be:

In addition, xmount also supports virtual write access to the output files that is redirected to a cache file. This makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox, VmWare or alike.

See Also

External Links