Well as I just pointed out it doesn't work with server 2008 64 bit, whereas a vm or a linux box with a samba share works just fine for analysis.
Have you tried the x64 version of VDK? ?
Here
http//
jaclaz
If you have VMware, the vmware-mount utility that's in the Disk Developers Kit works very well. I run it on XP and Vista 32/64 systems, and I can mount dd images of either of those systems quite easily. I have tried VDK64, and the results have been almost as good.
Okay, I've had some good results using IMDisk to mount an acquired image of a physical disk as a read-only file system.
Before getting into my own testing, I wanted to see what others may be using to mount an acquisition of a logical volume as a file system. For example, if you use FTK Imager to acquire an image of C\, instead of PhysicalDisk0…what are you using (if anything) to mount that image as a drive letter?
Thanks.
Mount Image Pro will work. The next release, now in beta, will offer more options for mounting an image. Support for FTK AD1 images is also in the works. If you want write access, you may be able to build a VM from the logical image and then use the utility I mentioned, though I've never built one from a logical image. I can see the need in cases in which you have to image logically. It's been a while, but I never had success with IMDisk.
jaclaz,
It apparently doesn't work on 64bit server 2008 without modifying the OS behavior and I'm not about to jeopardize the integrity of my machine to load the driver.
Just to clarify, driver signing means no guarantee of the quality of driver code or anything like that anyway, it just makes sure that you know who has published drivers you have installed. So, turning testsigning mode on means very little integrity risks added after all, and is still better than on 32-bit versions.
With testsigning turned on drivers still need to be signed but the certificate may be a local one you have created or downloaded to accept own drivers or drivers from a specific publisher. So, even with testsigning turned on a 64-bit Vista has more checks for integrity than a 32-bit Vista. (32-bit versions of Windows never checks for a signature before accepting to load a driver.)
Anyway, I understand your reaction, after all 64-bit Windows need to run in a somewhat less secure mode, but still, more secure than 32-bit Windows versions.