±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35734
New Yesterday: 1 Visitors: 114

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

OSFMount v Arsenal Image Mounter v FTK Imager

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3, 4  Next 
  

Sunnych
Newbie
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Jan 12, 19 14:12

- JimC
I've been recently been having a play with different image mounting tools.

PassMark's "OSFMount" looks pretty good and is free. It supports mounting E01 images but seems to have two limitations:

1. The driver performs a "logical" mount of file system volumes. It doesn't mount the underlying sectors in a "physical" disk image

2. The E01 feature is missing write support. This means it can't be used with virtualisation software to "live boot" an image

I also had a look at Arsenal's "Image Mounter (AIM)" tool. The basic version of this is free although a little more fiddly to use. There seems to be a more (expensive?) paid version which offers more features. Crucially, it does support mounting images "physical images".

Finally, I looked at "FTK Imager". This is free and offers both "physical" mounting and E01 support. For my purposes, it therefore seems superior to both OSFMount and AIM.

Does anyone have any comments or suggestions for other image mounting tools? Did I miss anything with PassMark's tool?
Jim
www.binarymarkup.com


read my article, sorry for the flaw that I wrote it in Russian, but I think an automatic translator in Google Chrome will help you, everything is clear and visible in the pictures and in the description with a real example
Virtualization of forensic images in Windows  
 
  

UnallocatedClusters
Senior Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Jan 13, 19 20:52

You should also consider GetData's MountImage Pro as an alternative (albeit not a free to use license).

I use OSFMount, Arsenal and FTK Imager as well in my practice (one can never have too many tools IMHO).

GetData's Forensic Explorer has an automated forensic image boot-to-VM capability, leveraging MountImage Pro, FYI.  
 
  

Passmark
Senior Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Jan 25, 19 08:31

Beta release of OSFMount with physical drives emulation is now available
www.osforensics.com/to...mages.html

The code signing process for the device driver took us way longer than it should have, the whole Microsoft process is a complete train wreck.

But there are some limits.
1) Raw format only, if mounting an existing image with physical drives emulation. (no E01 support (yet))
2) No command line with physical drives emulation (yet)
3) 64bit support only. No 32bit. We are never going back to 32bit now.
4) We've only tested on Win7 and Win10. No idea if Win8 will work.  
 
  

jaclaz
Senior Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Jan 25, 19 16:39

- Passmark
Beta release of OSFMount with physical drives emulation is now available

Good. Smile

- Passmark

3) 64bit support only. No 32bit. We are never going back to 32bit now.

Bad. Sad

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

keydet89
Senior Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Jan 26, 19 14:12

The fact that it's only available as 64-bit is irrelevant. It's free, and for that, I thank you. It's in the range for testing to demonstrate the usage.

Anyone who complains about a free 32-bit version not being available should be welcome to write their own, and provide it for free.  
 
  

Passmark
Senior Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Jan 28, 19 23:11

We track which O/S are in use with our benchmark software.

Here are the numbers.

Windows 10 (32-bit), 0.63%
Windows 10 (64-bit), 86.37%
Windows 7 (32-bit), 0.99%
Windows 7 (64-bit), 8.94%
Windows 8 (64-bit), 0.25%
Windows 8.1 (64-bit), 1.98%

Same data as a graph.
www.pcbenchmarks.net/o...share.html

So we can cover 96% of Windows users by just supporting Win7 and Win10 64bit.
A year from now it will likely be 98%. And I would expect people doing professional computer forensics to be ahead of the curve in terms of 64bit O/S usage.  
 
  

UnallocatedClusters
Senior Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Jan 28, 19 23:15

Why no love for Windows ME?

Also we are waiting on the Sinclair ZX Spectrum version please.  
 

Page 3 of 4
Page Previous  1, 2, 3, 4  Next