OSFMount v Arsenal ...
 
Notifications
Clear all

OSFMount v Arsenal Image Mounter v FTK Imager  

Page 2 / 2
  RSS
UnallocatedClusters
(@unallocatedclusters)
Senior Member

You should also consider GetData's MountImage Pro as an alternative (albeit not a free to use license).

I use OSFMount, Arsenal and FTK Imager as well in my practice (one can never have too many tools IMHO).

GetData's Forensic Explorer has an automated forensic image boot-to-VM capability, leveraging MountImage Pro, FYI.

ReplyQuote
Posted : 13/01/2019 7:52 pm
Passmark
(@passmark)
Active Member

Beta release of OSFMount with physical drives emulation is now available
https://www.osforensics.com/tools/mount-disk-images.html

The code signing process for the device driver took us way longer than it should have, the whole Microsoft process is a complete train wreck.

But there are some limits.
1) Raw format only, if mounting an existing image with physical drives emulation. (no E01 support (yet))
2) No command line with physical drives emulation (yet)
3) 64bit support only. No 32bit. We are never going back to 32bit now.
4) We've only tested on Win7 and Win10. No idea if Win8 will work.

ReplyQuote
Posted : 25/01/2019 7:31 am
jaclaz
(@jaclaz)
Community Legend

Beta release of OSFMount with physical drives emulation is now available

Good. )

3) 64bit support only. No 32bit. We are never going back to 32bit now.

Bad. (

jaclaz

ReplyQuote
Posted : 25/01/2019 3:39 pm
keydet89
(@keydet89)
Community Legend

The fact that it's only available as 64-bit is irrelevant. It's free, and for that, I thank you. It's in the range for testing to demonstrate the usage.

Anyone who complains about a free 32-bit version not being available should be welcome to write their own, and provide it for free.

ReplyQuote
Posted : 26/01/2019 1:12 pm
Passmark
(@passmark)
Active Member

We track which O/S are in use with our benchmark software.

Here are the numbers.

Windows 10 (32-bit), 0.63%
Windows 10 (64-bit), 86.37%
Windows 7 (32-bit), 0.99%
Windows 7 (64-bit), 8.94%
Windows 8 (64-bit), 0.25%
Windows 8.1 (64-bit), 1.98%

Same data as a graph.
https://www.pcbenchmarks.net/os-marketshare.html

So we can cover 96% of Windows users by just supporting Win7 and Win10 64bit.
A year from now it will likely be 98%. And I would expect people doing professional computer forensics to be ahead of the curve in terms of 64bit O/S usage.

ReplyQuote
Posted : 28/01/2019 10:11 pm
UnallocatedClusters
(@unallocatedclusters)
Senior Member

Why no love for Windows ME?

Also we are waiting on the Sinclair ZX Spectrum version please.

ReplyQuote
Posted : 28/01/2019 10:15 pm
Passmark
(@passmark)
Active Member

Updated beta release of OSFMount with physical drives emulation is now available
https://www.osforensics.com/tools/mount-disk-images.html

Main changes since last beta are,
+ Added support for non-RAW disk image files (AFF, VMDK, E01, etc.) when using Physical Disk emulation
+ Added Write Cache mode to allow mounting a virtual disk as read-write while preserving the data of the original image file (it creates delta files when writing data to the image)
+ Added support in the OSFMount CLI command line for mounting using Physical Disk emulation
+ Fixed a BSOD when mounting disk images as read/write when using Physical Disk emulation

Still needs some more testing however.

ReplyQuote
Posted : 08/03/2019 4:58 am
JimC
 JimC
(@jimc)
Member

I tried the latest beta with an E01 image of a physical drive. I mounted it as a physical drive in read-only mode (all other settings left as default).

The result was a emulated physical drive that appeared to be blank (every sector empty). The E01 works fine if mounted in XWF.

Jim

www.binarymarkup.com

ReplyQuote
Posted : 08/03/2019 4:39 pm
Passmark
(@passmark)
Active Member

Final V3 OSFMount release is out with a few bug fixes.

If anything still doesn't work correctly please let me know.

ReplyQuote
Posted : 17/04/2019 1:10 am
Page 2 / 2
Share: