The Hunters Hut
The Hunters Hut
Mounting Evidence Images
Mounting Evidence Images

Mounting Evidence Images

Mounting Digital Forensic Images

Mount Expert Witness formatted images

  1. First, mount the raw or ewf image to ewf_mount
ewfmount [image.E01] /mnt/ewf_mountmount -o ro,loop,show_sys_files,streams_interface=windows ewf1 /mnt/windows_mount

Alternatively

mountwin /mnt/ewf_mount/ewf1 /mnt/windows_mount

To save time and mount multiple partition types (GPT, E01, BitLocker, Logical, etc.) you can use imageMounter.py

imageMounter.py -s [image] /mnt/windows_mount
  1. Then mount the pre-mounted image to another folder to access the actual files
mount /mnt/ewf_[mount name] /mnt/windows_mount -ro
LinkedIn

ThreatHunterz.com