Difference between revisions of "Xmount"

From Forensics Wiki
Jump to: navigation, search
(External Links)
 
(7 intermediate revisions by one user not shown)
Line 2: Line 2:
 
   name = xmount |
 
   name = xmount |
 
   maintainer = [[Daniel Gillen]] |
 
   maintainer = [[Daniel Gillen]] |
   os = [[Linux]] , [[Mac OS X]] |
+
   os = [[Linux]], [[Mac OS X]] |
 
   genre = [[Image mounting]] |
 
   genre = [[Image mounting]] |
 
   license = {{GPL}} |
 
   license = {{GPL}} |
Line 8: Line 8:
 
}}
 
}}
  
Description taken from xmount site on Pinguin's HQ:
+
Description taken from xmount project site on Pinguin's HQ:
  
 +
xmount allows you to convert on-the-fly between multiple input and output harddisk image types. xmount creates a virtual file system using FUSE (Filesystem in Userspace) that contains a virtual representation of the input image.
  
xmount allows you to convert on-the-fly between multiple input and output harddisk image types. xmount creates a virtual file system using FUSE (Filesystem in Userspace) that contains a virtual representation of the input image. The virtual representation can be in [[Raw Image Format|raw DD]], VirtualBox's virtual disk file format or in [[VMWare Virtual Disk Format (VMDK)|VmWare's VMDK file format]]. Input images can be raw DD, [[Encase image file format|EWF (Expert Witness Compression Format)]] or [[AFF|AFF (Advanced Forensic Format)]] files. In addition, xmount also supports virtual write access to the output files that is redirected to a cache file. This makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox, VmWare or alike.
+
The virtual representation can be in:
 +
* [[Raw Image Format|raw DD]]
 +
* DMG
 +
* [[Virtual Hard Disk (VHD)|VHD]]
 +
* [[Virtual Disk Image (VDI)|VirtualBox's virtual disk file format]]
 +
* [[VMWare Virtual Disk Format (VMDK)|VmWare's VMDK file format]]
  
== Examples ==
+
Input images can be:
 +
* [[Raw Image Format|raw DD]]
 +
* [[Encase image file format|EWF (Expert Witness Compression Format)]]
 +
* [[AFF|AFF (Advanced Forensic Format)]]
  
See [http://files.pinguin.lu/projects/HOWTO-BootingAcquiredWindows.pdf HOWTO: Booting an acquired hard disk image containing a Windows installation using xmount and OpenGates].
+
In addition, xmount also supports virtual write access to the output files that is redirected to a cache file. This makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox, VmWare or alike.
  
 
== See Also ==
 
== See Also ==
Line 23: Line 32:
  
 
* [https://www.pinguin.lu/index.php Pinguin's HQ]
 
* [https://www.pinguin.lu/index.php Pinguin's HQ]
 +
* [http://files.pinguin.lu/projects/HOWTO-BootingAcquiredWindows.pdf HOWTO: Booting an acquired hard disk image containing a Windows installation using xmount and OpenGates].
 +
* [http://linuxsleuthing.blogspot.ch/2013/03/xmount-when-changing-evidence-isnt-so.html Xmount: When "Changing" the Evidence isn't so Bad], by [[John Lehr]], March 21, 2013

Latest revision as of 01:47, 27 March 2013

xmount
Maintainer: Daniel Gillen
OS: Linux, Mac OS X
Genre: Image mounting
License: GPL
Website: www.pinguin.lu

Description taken from xmount project site on Pinguin's HQ:

xmount allows you to convert on-the-fly between multiple input and output harddisk image types. xmount creates a virtual file system using FUSE (Filesystem in Userspace) that contains a virtual representation of the input image.

The virtual representation can be in:

Input images can be:

In addition, xmount also supports virtual write access to the output files that is redirected to a cache file. This makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox, VmWare or alike.

See Also

External Links