±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35144
New Yesterday: 5 Visitors: 160

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Mounting an image

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3, 4, 5, 6, 7, 8, 9, 10  Next 
  

Re: Mounting an image

Post Posted: Thu Mar 29, 2007 2:13 pm

I've posted to my blog about a real-world use of this...works great. I'm scanning an image mounted as "K:\" now...

windowsir.blogspot.com...image.html  

keydet89
Senior Member
 
 
  

Re: Mounting an image

Post Posted: Mon Apr 02, 2007 9:05 pm

Harlan,

Thanks for the link. This is exactly what I was looking for !  

BraneRift
Senior Member
 
 
  

Re: Mounting an image

Post Posted: Tue Apr 03, 2007 8:37 am

Harlan,
you can mount in vdk raw image,whithout converting image to vmdk.  

Marat
Member
 
 
  

Re: Mounting an image

Post Posted: Tue Apr 03, 2007 11:16 am

Marat,

I don't know...I haven't tried. Why don't you try it and let us know? I know I'd greatly appreciate it if you did.

Thanks,

Harlan  

keydet89
Senior Member
 
 
  

Re: Mounting an image

Post Posted: Tue Apr 03, 2007 4:08 pm

Harlan,
sorry for my bad english.
Vdk can mount raw image. Smile  

Marat
Member
 
 
  

Re: Mounting an image

Post Posted: Tue Apr 03, 2007 5:01 pm

Great...can you share the process/command line?  

keydet89
Senior Member
 
 
  

Re: Mounting an image

Post Posted: Tue Apr 03, 2007 5:56 pm

yes
for example

vdk view D:\EVIDENCE_LOCKER\HASHSETS.001

Failed to decide type of 'd:\evidence_locker\hashsets.001'.
Open as a simple sector image file.
Image Name : hashsets
Disk Capacity : 2097152 sectors (1024 MB)
Number Of Files : 1

Type Size Path
------- ------- ----
FLAT 2097152 d:\evidence_locker\hashsets.001

Partitions :
# Start Sector Length in sectors Type
-- ------------ --------------------- ----
0 0 2097152 ( 1024 MB) NTFS

and

vdk open * D:\EVIDENCE_LOCKER\HASHSETS.001 /WB /L:G
/WB write block
/L:G G-drive letter  

Marat
Member
 
 

Page 5 of 10
Go to page Previous  1, 2, 3, 4, 5, 6, 7, 8, 9, 10  Next