±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35750
New Yesterday: 4 Visitors: 163

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Mounting an image

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3, 4, 5, 6, 7, 8, 9, 10  Next 
  

Marat
Member
 

Re: Mounting an image

Post Posted: Mar 15, 07 19:03

 
  

hogfly
Senior Member
 

Re: Mounting an image

Post Posted: Mar 15, 07 19:46

- bgrundy


Unless things have changed recently, Cygwin does not have that capability in windows, although you *can* use something like FileDisk (http://www.acc.umu.se/~bosse/) to create target mounts for Cygwin. One of our techs tested this when it first came out (not sure if he used it with Cygwin or not) and he sent us out a notice about it.
Barry
NASA OIG CCD
(from the Bat Cave)


You're right that was my bad. I thought they'd finally added it, but guess not.  
 
  

keydet89
Senior Member
 

Re: Mounting an image

Post Posted: Mar 15, 07 20:20

Marat,

I'll definitely have to take a look at VDK.

Does anyone have any experience with it?

H  
 
  

Marat
Member
 

Re: Mounting an image

Post Posted: Mar 15, 07 22:44

keydet89,
Does anyone have any experience with it?


yes Very Happy

very good tool for mount dd image.I think ,getdata used experience of vdk for making "mount image pro".
old version of "mount image pro" and vdk use identical command etc.  
 
  

keydet89
Senior Member
 

Re: Mounting an image

Post Posted: Mar 15, 07 23:43

After looking around a bit, here's what I've found (with the caveat that I've tested portions of this at various points, but not all of it together)...

With a dd image of a system, taken with FTK Imager Lite, ProDiscover, or plain ol' dd, you can then use either LiveView or even ProDiscover to create the necessary .vmdk files. From there, get the following:

VDK
chitchat.at.infoseek.c...e/vdk.html

VDK GUI
petruska.stardock.net/...Mware.html
**Don't forget the core files

Alternatively, you can use Virtual Drive Manager:
home.graffiti.net/jacl...M/vdm.html

At this point, you should have everything you need to mount a dd-image as a read-only drive letter. I tried using the VMWare-mount utility (DiskMount), but it is NOT read-only.

Again, like I said, I haven't testing this all the way through...but I have used LiveView before, and I pointed VDK at a .vmdk file from one of my VMWare sessions and was successful in mounting the K: drive. This was against an XP VMWare session.

Thanks for your help everyone! Unfortunately, this issue came up *after* the chapter of my book that talks about alternative methods of analysis went to production! Wink  
 
  

hogfly
Senior Member
 

Re: Mounting an image

Post Posted: Mar 16, 07 00:22

Maybe something for the website that supports the book?  
 
  

keydet89
Senior Member
 

Re: Mounting an image

Post Posted: Mar 16, 07 00:25

Without a doubt...wait, there's a website??? Wink  
 

Page 2 of 10
Page Previous  1, 2, 3, 4, 5, 6, 7, 8, 9, 10  Next