Mounting Disk Images - Revision history

Keydet89: /* Free Tools */

2011-08-23T20:35:47Z

‎Free Tools

2011-08-23T20:31:12Z

‎Free Tools

2009-11-09T22:39:23Z

2009-11-04T12:15:17Z

‎kpartx

2009-11-04T12:14:00Z

‎kpartx

2009-08-10T05:46:21Z

‎To mount a disk image on Linux using kpartx

2009-08-08T17:15:58Z

‎Linux

2009-07-26T18:09:11Z

2008-12-20T20:28:16Z

2008-10-26T08:41:55Z

Category:Howtos

@@ Line 83: / Line 83: @@
 * Paraben's [http://www.paraben-forensics.com/catalog/product_info.php?cPath=25&products_id=268 P2 Explorer]
 * [http://www.vmxbuilder.com/vdk-gui/ VDKWin], requires [http://chitchat.at.infoseek.co.jp/vmware/vdk.html VDK]
 == Commercial Tools ==

@@ Line 79: / Line 79: @@
 == Free Tools ==
 * [http://www.ltr-data.se/opencode.html#ImDisk ImDisk] - also on [http://en.wikipedia.org/wiki/ImDisk WikiPedia]
 * Paraben's [http://www.paraben-forensics.com/catalog/product_info.php?cPath=25&products_id=268 P2 Explorer]

← Older revision		Revision as of 22:39, 9 November 2009
Line 72:		Line 72:

	* [http://sansforensics.wordpress.com/2008/12/18/mounting-images-using-alternate-superblocks/ Mounting Images Using Alternate Superblocks]		* [http://sansforensics.wordpress.com/2008/12/18/mounting-images-using-alternate-superblocks/ Mounting Images Using Alternate Superblocks]
		+
		+	= Windows =
		+
		+	MS Windows does not include a native means for mounting acquired images. However, there are tools available for mounting acquired images on Windows systems.
		+
		+	== Free Tools ==
		+
		+	* [http://www.ltr-data.se/opencode.html#ImDisk ImDisk] - also on [http://en.wikipedia.org/wiki/ImDisk WikiPedia]
		+	* Paraben's [http://www.paraben-forensics.com/catalog/product_info.php?cPath=25&products_id=268 P2 Explorer]
		+	* [http://www.vmxbuilder.com/vdk-gui/ VDKWin], requires [http://chitchat.at.infoseek.co.jp/vmware/vdk.html VDK]
		+
		+	== Commercial Tools ==
		+
		+	* [http://www.asrdata.com/SmartMount/ SmartMount]
		+	* [http://www.mountimage.com/ Mount Image Pro] - has a 14-day trial version

	[[Category:Howtos]]		[[Category:Howtos]]

@@ Line 48: / Line 48: @@
       rawimage.dd5               2           2        8001   83  Linux
-creates the command
+The command
   #   kpartx -v -a rawimage.dd
-this mappings
+creates these mappings
      /dev/mapper/loop0p1
@@ Line 58: / Line 58: @@
      /dev/mapper/loop0p5
-The Partitions can now mount easy with
+The partitions can be mounted with these commands:
   # mount /dev/mapper/loop0p1 /media/suspectHD_01/ -o ro

@@ Line 41: / Line 41: @@
 ===kpartx===
-Mounting raw images with multiple partitions is easy with ''kpartx''. Type ''aptitude install kpartx'' as root to install ''kpartx'' unter Debian. ''kpartx'' is creating device-mappings for each partition. If the raw image looks like this:
+Mounting raw images with multiple partitions is easy with ''kpartx''. Type ''aptitude install kpartx'' as root to install ''kpartx'' under Debian. ''kpartx'' is creating device-mappings for each partition. If the raw image looks like this:
          Device        Boot      Start       End      Blocks Id  System

@@ Line 38: / Line 38: @@
   # mount -t vfat -o loop,offset=32256,ro,noexec img.dd /mnt/tmp_1
   # mount -t vfat -o loop,offset=20974464000,ro,noexec img.dd /mnt/tmp_2
 ==To unmount==

@@ Line 26: / Line 26: @@
 ==To mount a disk image on [[Linux]]==
-  # mount -t vfat -o loop=/dev/loop0,ro,noexec img.dd /mnt
+  # mount -t vfat -o loop,ro,noexec img.dd /mnt
--or-
- # mount -t vfat -o loop=/dev/loop/0,ro,noexec img.dd /mnt
-The '''''ro''''' is for read-only (loop device is required since some file systems can alter the data even with '''''ro''''' option).
+The '''''ro''''' is for read-only.
 This will mount NSRL ISOs:
-   # mount /home/simsong/RDS_218_A.iso /mnt/nsrl -t iso9660 -o loop=/dev/loop3,ro,noexec
+   # mount /home/simsong/RDS_218_A.iso /mnt/nsrl -t iso9660 -o loop,ro,noexec
-Some raw images contains multiple partitions (full HD image). In this case, it's necessary to specify a starting offset for each partition.
+  # mount -t vfat -o loop,offset=32256,ro,noexec img.dd /mnt/tmp_1
   # mount -t vfat -o loop,offset=20974464000,ro,noexec img.dd /mnt/tmp_2
-  # mount -t vfat -o loop=/dev/loop0,offset=32256,ro,noexec img.dd /mnt/tmp_1
-  # mount -t vfat -o loop=/dev/loop1,offset=20974464000,ro,noexec img.dd /mnt/tmp_2
-−
-−
-'''Note: You may need to say /dev/loop/0 instead of /dev/loop0 on some systems'''
 ==To unmount==

← Older revision		Revision as of 20:28, 20 December 2008
Line 50:		Line 50:

	# umount /mnt		# umount /mnt
		+
		+	== Mounting Images Using Alternate Superblocks ==
		+
		+	* [http://sansforensics.wordpress.com/2008/12/18/mounting-images-using-alternate-superblocks/ Mounting Images Using Alternate Superblocks]

	[[Category:Howtos]]		[[Category:Howtos]]