±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34981
New Yesterday: 2 Visitors: 174

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

OSFMount v Arsenal Image Mounter v FTK Imager

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3 
  

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Sat Jan 12, 2019 7:12 am

- JimC
I've been recently been having a play with different image mounting tools.

PassMark's "OSFMount" looks pretty good and is free. It supports mounting E01 images but seems to have two limitations:

1. The driver performs a "logical" mount of file system volumes. It doesn't mount the underlying sectors in a "physical" disk image

2. The E01 feature is missing write support. This means it can't be used with virtualisation software to "live boot" an image

I also had a look at Arsenal's "Image Mounter (AIM)" tool. The basic version of this is free although a little more fiddly to use. There seems to be a more (expensive?) paid version which offers more features. Crucially, it does support mounting images "physical images".

Finally, I looked at "FTK Imager". This is free and offers both "physical" mounting and E01 support. For my purposes, it therefore seems superior to both OSFMount and AIM.

Does anyone have any comments or suggestions for other image mounting tools? Did I miss anything with PassMark's tool?
Jim
www.binarymarkup.com


read my article, sorry for the flaw that I wrote it in Russian, but I think an automatic translator in Google Chrome will help you, everything is clear and visible in the pictures and in the description with a real example
Virtualization of forensic images in Windows  

Sunnych
Newbie
 
 
  

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Sun Jan 13, 2019 1:52 pm

You should also consider GetData's MountImage Pro as an alternative (albeit not a free to use license).

I use OSFMount, Arsenal and FTK Imager as well in my practice (one can never have too many tools IMHO).

GetData's Forensic Explorer has an automated forensic image boot-to-VM capability, leveraging MountImage Pro, FYI.  

UnallocatedClusters
Senior Member
 
 

Page 3 of 3
Go to page Previous  1, 2, 3