Mounting Evidence Images
Mounting Evidence Images

Mounting Evidence Images

Mounting Digital Forensic Images

Mount Expert Witness formatted images

  1. First, mount the raw or ewf image to ewf_mount
ewfmount [image.E01] /mnt/ewf_mountmount -o ro,loop,show_sys_files,streams_interface=windows ewf1 /mnt/windows_mount

Alternatively

mountwin /mnt/ewf_mount/ewf1 /mnt/windows_mount

To save time and mount multiple partition types (GPT, E01, BitLocker, Logical, etc.) you can use imageMounter.py

imageMounter.py -s [image] /mnt/windows_mount
  1. Then mount the pre-mounted image to another folder to access the actual files
mount /mnt/ewf_[mount name] /mnt/windows_mount -ro