±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35399
New Yesterday: 0 Visitors: 178

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Mounting an image

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3, 4, 5, 6, 7, 8, 9, 10  Next 
  

keydet89
Senior Member
 

Re: Mounting an image

Post Posted: Mar 29, 07 14:13

I've posted to my blog about a real-world use of this...works great. I'm scanning an image mounted as "K:\" now...

windowsir.blogspot.com...image.html  
 
  

BraneRift
Senior Member
 

Re: Mounting an image

Post Posted: Apr 02, 07 21:05

Harlan,

Thanks for the link. This is exactly what I was looking for !  
 
  

Marat
Member
 

Re: Mounting an image

Post Posted: Apr 03, 07 08:37

Harlan,
you can mount in vdk raw image,whithout converting image to vmdk.  
 
  

keydet89
Senior Member
 

Re: Mounting an image

Post Posted: Apr 03, 07 11:16

Marat,

I don't know...I haven't tried. Why don't you try it and let us know? I know I'd greatly appreciate it if you did.

Thanks,

Harlan  
 
  

Marat
Member
 

Re: Mounting an image

Post Posted: Apr 03, 07 16:08

Harlan,
sorry for my bad english.
Vdk can mount raw image. Smile  
 
  

keydet89
Senior Member
 

Re: Mounting an image

Post Posted: Apr 03, 07 17:01

Great...can you share the process/command line?  
 
  

Marat
Member
 

Re: Mounting an image

Post Posted: Apr 03, 07 17:56

yes
for example

vdk view D:\EVIDENCE_LOCKER\HASHSETS.001

Failed to decide type of 'd:\evidence_locker\hashsets.001'.
Open as a simple sector image file.
Image Name : hashsets
Disk Capacity : 2097152 sectors (1024 MB)
Number Of Files : 1

Type Size Path
------- ------- ----
FLAT 2097152 d:\evidence_locker\hashsets.001

Partitions :
# Start Sector Length in sectors Type
-- ------------ --------------------- ----
0 0 2097152 ( 1024 MB) NTFS

and

vdk open * D:\EVIDENCE_LOCKER\HASHSETS.001 /WB /L:G
/WB write block
/L:G G-drive letter  
 

Page 5 of 10
Page Previous  1, 2, 3, 4, 5, 6, 7, 8, 9, 10  Next