Difference between pages "Internet Explorer" and "Xmount"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(External Links)
 
Line 1: Line 1:
{{Expand}}
+
{{Infobox_Software |
 +
  name = xmount |
 +
  maintainer = [[Daniel Gillen]] |
 +
  os = [[Linux]], [[Mac OS X]] |
 +
  genre = [[Image mounting]] |
 +
  license = {{GPL}} |
 +
  website = [https://www.pinguin.lu/index.php www.pinguin.lu] |
 +
}}
  
Microsoft Internet Explorer (MSIE) is the default [[Web Browser]] included with [[Microsoft Windows]].
+
Description taken from xmount project site on Pinguin's HQ:
  
== MSIE 10 ==
+
xmount allows you to convert on-the-fly between multiple input and output harddisk image types. xmount creates a virtual file system using FUSE (Filesystem in Userspace) that contains a virtual representation of the input image.
  
<pre>
+
The virtual representation can be in:
C:\Users\%USER%\AppData\Local\Microsoft\Windows\WebCache\
+
* [[Raw Image Format|raw DD]]
</pre>
+
* DMG
 +
* [[Virtual Hard Disk (VHD)|VHD]]
 +
* [[Virtual Disk Image (VDI)|VirtualBox's virtual disk file format]]
 +
* [[VMWare Virtual Disk Format (VMDK)|VmWare's VMDK file format]]
  
== See Also ==
+
Input images can be:
 +
* [[Raw Image Format|raw DD]]
 +
* [[Encase image file format|EWF (Expert Witness Compression Format)]]
 +
* [[AFF|AFF (Advanced Forensic Format)]]
  
* [[Internet Explorer History File Format]], applies to MSIE 4, 5 to 9
+
In addition, xmount also supports virtual write access to the output files that is redirected to a cache file. This makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox, VmWare or alike.
 +
 
 +
== See Also ==
 +
* [[Disk Images]]
  
 
== External Links ==
 
== External Links ==
* [http://www.microsoft.com/en-us/download/details.aspx?id=11575 Windows Virtual PC VHDs for testing websites with different Internet Explorer versions], by [[Microsoft]]
 
* [http://kb.digital-detective.co.uk/display/NetAnalysis1/Internet+Explorer+Cache Internet Explorer Cache]
 
* [http://support.microsoft.com/kb/182569 Internet Explorer security zones registry entries for advanced users], by [[Microsoft]]
 
* [http://www.swiftforensics.com/2011/09/internet-explorer-recoverystore-aka.html Internet Explorer RecoveryStore (aka Travelog) as evidence of Internet Browsing activity], by [[Yogesh Khatri]], September 29, 2011
 
  
[[Category:Applications]]
+
* [https://www.pinguin.lu/index.php Pinguin's HQ]
[[Category:Web Browsers]]
+
* [http://files.pinguin.lu/projects/HOWTO-BootingAcquiredWindows.pdf HOWTO: Booting an acquired hard disk image containing a Windows installation using xmount and OpenGates].
 +
* [http://linuxsleuthing.blogspot.ch/2013/03/xmount-when-changing-evidence-isnt-so.html Xmount: When "Changing" the Evidence isn't so Bad], by [[John Lehr]], March 21, 2013

Latest revision as of 02:47, 27 March 2013

xmount
Maintainer: Daniel Gillen
OS: Linux, Mac OS X
Genre: Image mounting
License: GPL
Website: www.pinguin.lu

Description taken from xmount project site on Pinguin's HQ:

xmount allows you to convert on-the-fly between multiple input and output harddisk image types. xmount creates a virtual file system using FUSE (Filesystem in Userspace) that contains a virtual representation of the input image.

The virtual representation can be in:

Input images can be:

In addition, xmount also supports virtual write access to the output files that is redirected to a cache file. This makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox, VmWare or alike.

See Also

External Links