My goal is to mount images in a Linux virtual machine (the SIFT Workstation 2.0) and, by using the shared folders feature of VirtualBox, make that mounted images available to be examined by the Windows host operating system. This is so that I can do the majority of my examination with the Linux tools loaded on the SIFT Workstation, but also have Windows tools scan the image.
The problem I have is that when I mount images into a shared folder the folder appears to the host OS as empty. I notice that they have a padlock icon over the top right corner of the folder icon for the specific directory when the the directory is viewed from the File Browser.
This image was mounted with the following command
root@SIFT-Workstation/mnt/Share# mount -t ntfs-3g -o loop,ro,show_sys_files Test_extract_partition.img Extracted_Partition/
I tried doing a chmod og=r Extracted_Partition/ -R (as root), but that only resulted in a "Read-Only file system" message for every file and directory in the mounted file system, lol. The same thing happened when i tried chgrp users Extracted_Partition/ -R.
The weird thing is that if I do an ls -l, i get the following
root@SIFT-Workstation/mnt/Share# ls -l
drwxrwxrwx 1 root root 4096 2010-07-27 1921 Extracted_Partition
and its the same for the files and folders inside that directory.
Is there a way to modify the mount command I'm using so that my Windows Host can view the mounted files?
try adding
umask=0222,uid=forensic,gid=users
Thanks for the suggestion. This particular disk partition is NTFS so all those options you suggested worked are valid.
When I run this command though
sansforensics@SIFT-Workstation/mnt/Share$ sudo mount -t ntfs-3g -o loop,ro,show_sys_files,umask=0222,uid=forensic,gid=users Test_extract_partition.img Extracted_Partition/
the image mounts just like before with the lock icon on the folder.