Mount Forensics Ima...
 
Notifications
Clear all

Mount Forensics Image on Macpro

5 Posts
4 Users
0 Reactions
5,989 Views
nightworker
(@nightworker)
Estimable Member
Joined: 16 years ago
Posts: 134
Topic starter  

How to Mount Forensics Image on Macpro? ? ? ?


   
Quote
Igor_Michailov
(@igor_michailov)
Honorable Member
Joined: 20 years ago
Posts: 529
 

SmartMount
http//www.asrdata.com/forensic-software/smartmount/


   
ReplyQuote
(@davepawlak)
Eminent Member
Joined: 15 years ago
Posts: 29
 

Which OS is the Mac Pro booted to?

What is the format of the image file you want to mount?

Too many variables to just "give" you an answer…but there are several ways to accomplish this task.

Free Options
-If OS X and DD, using COMMAND+I append ".DMG" and check the "LOCKED" checkbox. Once you've done this, double click the DMG and voila, it's mounted.

-If OS X and E01, you will need to get libewf installed on your computer. You can do this by downloading from MacPorts or HomeBrew or assembling from source if you are comfortable. Then use the "ewfmount" command.

-You could use a tool like xmount to create a VM of the DD/E01 or raw2vmdk for DD only format and boot it in VirtualBox (Free), or Fusions/Parallels (Paid).

Paid Options
Sumuri Recon
BlackLight (Includes an EWFMount GUI)

For Windows you could use
Free Options
FTKImager
EWFMount

Paid Options
Smart Mount
Mount Image Pro / Forensic Explorer
iLookIX
X-Ways

You could boot the Mac Pro to a Linux Boot Disk and mount with many tools likely preinstalled on a forensic boot disk like Paladin or DEFT.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

For Windows you could use
Free Options
FTKImager
EWFMount

JFYI, if you are fine with mounting volumes only IMDISK will do for dd images and through a proxy also for EWF and some other image formats (making use of libewf)
http//reboot.pro/topic/19942-vmdk-proxy-for-imdisk/
http//reboot.pro/topic/19940-ewf-proxy-for-imdisk/

And as well OFSMount (originally based on IMDISK) would do nicely in most cases and in a more "transparent" way
http//www.osforensics.com/tools/mount-disk-images.html

jaclaz


   
ReplyQuote
(@davepawlak)
Eminent Member
Joined: 15 years ago
Posts: 29
 

…IMDISK will do for dd images and through a proxy also for EWF and some other image formats (making use of libewf)

jaclaz

IMDISK completely skipped my mind. IMDISK is bundled with BelkaSoft Evidence Center and hs worked well in the past. Good addition…


   
ReplyQuote
Share: