Hi,
What is the best way to restore and mount raw data images? I know that FTK basically resassembles mounts them to do its own analysis, but what if I want to restore and mount a raw image file to examine with DOS or open source tools? Does "ISO Buster" have this capability? Or is there something easier to use?
Thanks,
Mike
Several posts on the manual procedure or you can use Mount Image Pro v2 .
http//
Thanks Guys! D
I've used this method from Harlans blog quite a few times with great success.
Another option for creating the .vmdk file is to use LiveView. Point LiveView at the dd image, choose "Generate Config Only" in the GUI (maybe even designate the OS rather than having LiveView guess it) and you'll end up with several files, to include two .vmdk files and a snapshot. LiveView makes use of the VMWare DiskMount utility (don't forget the free VMPlayer), and even though this does not mount the image as a read-only file structure, you can set the read attribute on the image file itself (attrib +r imagefile) as a precaution. Use the vmware-mount.exe to mount the snapshot (imagefile-000001.vmdk)and all of the writes will end up in the snapshot.