Overview

OSFMount allows you to mount local disk image files (bit-for-bit copies of an entire disk or disk partition) in Windows as a physical disk or a logical drive letter. You can then analyze the disk image file with PassMark OSForensics™ by using the physical disk name (eg. \\.\PhysicalDrive1) or logical drive letter (eg. Z:).

By default, the image files are mounted as read only so that the original image files are not altered.

OSFMount supports mounting disk image files as read/write in “write cache” mode. This stores all writes to a “write cache” (or “delta”) file which preserves the integriy of the original disk image file.

OSFMount also supports the creation of RAM disks, basically a disk mounted into RAM. This generally has a large speed benefit over using a hard disk. As such this is useful with applications requiring high speed disk access, such a database applications, games (such as game cache files) and browsers (cache files). A second benefit is security, as the disk contents are not stored on a physical hard disk (but rather in RAM) and on system shutdown the disk contents are not persistent. At the time of writing, we believe this is the fastest RAM drive software available.

OSFMount supports mounting images of CDs in .ISO format , which can be useful when a particular CD is used often and the speed of access is important.

Download

Download the 64-bit OSFMount software for free!

Known issues

#1: On certain Windows systems (mostly Windows server 2016), when using OSFMount, Windows will prevent the OSFMount driver from loading. See the following page for more details, “Why do I get the error, Error loading OSFMount Driver?”

#2: If you get an Access Denied message during install for the osfmount.sys file, or OSFmount driver is disabled error. Reboot the machine and reinstall. A previous version of the driver was likely still loaded in memory, preventing an update.

Supported File Extensions

OSFMount supports the mounting of the following Windows image file formats:

* The supported version of Advanced Forensics Format is AFFv3 with zlib compression support. Encryption and signatures are not supported.

RAM Drive Benchmarks

These RAM drive benchmarks were taken on a Intel i7-12700K CPU with 64GB DDR5 RAM @ 4800MHz in dual channel mode. RAM disk size was 8GB, formatted with FAT32. Typical speeds with large linear blocks are around 10,000 MiB/sec reads and 20,000 MiB/sec writes. With smaller 4K blocks and random access plus queue depth of 1, speed is still a very respectable 1,900 MiB/sec read and 1,000 MiB/sec write. Benchmarks were taken with PerformanceTest V11.

System requirements

Win 10 and Win 11
Win 7 SP1, Win 8, Windows Server 2008, 2012 (Windows Server 2016 has issues) are supported but have not been validated
64bit support (For 32-bit support, please use OSFMount v2)
CPU with SSE4.2 instruction set (i.e. CPUs released after 2010)
Users must have administrator privileges.
RAM: 1GB (When mounting large disk images, the more RAM the better)
Disk space: 15 MB of free hard disk space for the installation files.