±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35615
New Yesterday: 1 Visitors: 161

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

OSFMount v Arsenal Image Mounter v FTK Imager

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3, 4  Next 
  

JimC
Senior Member
 

OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Oct 15, 18 09:26

I've been recently been having a play with different image mounting tools.

PassMark's "OSFMount" looks pretty good and is free. It supports mounting E01 images but seems to have two limitations:

1. The driver performs a "logical" mount of file system volumes. It doesn't mount the underlying sectors in a "physical" disk image

2. The E01 feature is missing write support. This means it can't be used with virtualisation software to "live boot" an image

I also had a look at Arsenal's "Image Mounter (AIM)" tool. The basic version of this is free although a little more fiddly to use. There seems to be a more (expensive?) paid version which offers more features. Crucially, it does support mounting images "physical images".

Finally, I looked at "FTK Imager". This is free and offers both "physical" mounting and E01 support. For my purposes, it therefore seems superior to both OSFMount and AIM.

Does anyone have any comments or suggestions for other image mounting tools? Did I miss anything with PassMark's tool?

Jim

www.binarymarkup.com  
 
  

minime2k9
Senior Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Oct 15, 18 09:59

Arsenal Recon is the best one I have used. I don't have access to the paid features but they revolve around mounting VSC's directly.

Encase does have PDE which also allows mounting of physical disks, but overkill if that's the only feature you want.  
 
  

Passmark
Senior Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Oct 16, 18 03:50

Mounting a E01 image as a volume or as a emulated physical SCSI drive accomplishes the same thing most of the time. All the sectors in all the partitions are still available in both cases. But as you pointed out there are a few cases where the difference is important. One of them is booting the image into a virtual machine, where a (emulated) physical drive is desirable. Strictly speaking there are other methods to boot the image without a physical drive, but having one make the job quicker & easier.

We are writing code at the moment to allow a physical mount option for OSFMount.
An updated version should be available in a few weeks after a bit more integration and testing.  
 
  

Omnius
Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Oct 16, 18 07:04

- minime2k9
Arsenal Recon is the best one I have used. I don't have access to the paid features but they revolve around mounting VSC's directly.


Using AR in conjunction with; binaryforay.blogspot.c...mount.html for VSC analysis.

Using FTK for physical mounting of drives for creating VM's.  
 
  

minime2k9
Senior Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Oct 16, 18 08:35

- Omnius

Using AR in conjunction with; binaryforay.blogspot.c...mount.html for VSC analysis.

Using FTK for physical mounting of drives for creating VM's.


Yes that is how I use AR for mounting VSC's, same technique works for creating VM's as well.
I meant paid features allow you to mount a VSC directly rather than mounting the image and then the VSC.  
 
  

jaclaz
Senior Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Oct 16, 18 09:30

@JimC
JFYI, the "base" under the OFSMount tool is IMDISK, by Olof Lagerkvist, who is the same Author as Arsenal Image Mounter.

While IMDISK is completely free, besides Open Source, the AIM was developed for Arsenal Recon, it is now extremely complicated to get it, and seemingly they just switched to the "modern"[1] SAAS commercial model (and seemingly also require registration to download the "free"[2] version)

However there is a small GUI tool for it:
reboot.pro/files/file/374-imgmount/


There is another driver that comes from MS directly, that has the same possibility of mounting a (RAW) physical image (again JFYI):
reboot.pro/topic/6492-...ge-driver/

jaclaz



[1] "modern" is sometimes a synonym of "stupid" in my opinion
[2] that as such is not anymore "free", again in my perverted mind
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

ArsenalConsulting
Member
 

Re: OSFMount v Arsenal Image Mounter v FTK Imager

Post Posted: Oct 16, 18 10:33

- jaclaz

While IMDISK is completely free, besides Open Source, the AIM was developed for Arsenal Recon, it is now extremely complicated to get it, and seemingly they just switched to the "modern"[1] SAAS commercial model (and seemingly also require registration to download the "free"[2] version)


Can you elaborate upon "extremely complicated?" I had previously signed up for our mailing list and just went to our website, clicked "Downloads", expanded "Arsenal Image Mounter", clicked "Arsenal Image Mounter", and a download began. We could eliminate one of the those three clicks (making the navigation more efficient) and I will see about getting that done this week.

- jaclaz

[2] that as such is not anymore "free", again in my perverted mind


We are a small company and do not have marketing people. We require signing-up for our mailing list before downloading our tools, which is the primary method we use to alert current (and prospective, in the sense that they have already shown interest) users to updates in our existing tools and the launch of new tools. People can (and do) use throw-away email addresses and unsubscribe to our mailing list after they have downloaded what they want.

We don't charge for Arsenal Image Mounter's core functionality and have source code available on GitHub which we encourage open source projects to use. I feel we have launched quite a bit of free functionality in both Arsenal Image Mounter and Hibernation Recon, especially when you consider that Olof Lagerkvist is an excellent programmer (as are some of our other employees and contractors) and he does not work for free.

On a related note, developing software tends to be a way for us to lose money, not make it. If we did not have a successful consulting business, we would not be building software. Regardless, we will continue to fund more free functionality in Arsenal Image Mounter and I am open to suggestions related to that functionality, our GUI, mailing list, etc.

Thanks,

Mark Spencer, President
Arsenal Consulting, Inc.
ArsenalExperts.com
@ArsenalArmed  
 

Page 1 of 4
Page 1, 2, 3, 4  Next