ARSENAL IMAGE MOUNTER

 

ARSENAL IMAGE MOUNTER

Many Windows®-based disk image mounting solutions mount the contents of disk images as shares or partitions, rather than complete (a/k/a “physical” or “real”) disks, which limits their usefulness to digital forensics practitioners and others. Arsenal Image Mounter mounts the contents of disk images as complete disks in Windows. As far as Windows is concerned, the contents of disk images mounted by Arsenal Image Mounter are real SCSI disks, allowing users to benefit from disk-specific features like integration with Disk Manager, launching virtual machines (and then bypassing Windows authentication), managing BitLocker-protected volumes, mounting Volume Shadow Copies, and more.

 

If AIM is run without a license, it will run in “Free Mode” and provide core functionality. If AIM is licensed, it will run in “Professional Mode” with full functionality enabled. Information for developers about the use of AIM’s source code and APIs, along with other information, can be found in Arsenal Recon’s FAQ.

 

  • Arsenal Image Mounter v2.0.007 – Windows 7 – Splash Screen
  • Windows 7 – Nothing Mounted
  • Windows 7 – Mount Options
  • Windows 7 – Disk Images Mounted
  • Windows 7 – Disk Images with Details Mounted
  • Windows 7 – Disk Management after Disk Images Mounted
  • Windows 7 – Driver Details after Disk Images Mounted
  • Windows 8.1 – Disk Images with Details Mounted
Free Mode
  • Mount raw, forensic, and virtual machine disk images as “real” disks on Windows
  • Temporary write support with replayable delta files for all supported disk image formats
  • Save “physically” mounted objects to various disk image formats
  • Virtually mount optical images
  • RAM disk creation
  • Command-line interface (CLI) executables
  • MBR injection, “fake” disk signatures, removable disk emulation, and much more

 

Professional Mode offers all Free Mode functionality plus:

 

  • Effortlessly launch (and often login to) virtual machines
  • Volume Shadow Copy mounting with optional Windows NTFS driver bypass
  • Windows file system driver bypass support for disk image mounting
  • Virtually mount archives and directories
  • Save disk images with fully-decrypted BitLocker volumes

 

 

Complete Mounting

Mount contents of disk images and virtual machines as complete or “real” disks on Windows

 

 

Forensic Features

Temporary write support, “fake” disk signatures, CLI version, and more

Volume Shadow Copies

Quickly mount all Volume Shadow Copies (VSCs) within a disk image

 

Interesting Features

  • Mounts raw, forensic, and virtual machine disk images
  • Temporary write support
  • “Fake” disk signatures
  • Removable disk emulation
  • Volume Shadow Copy (VSC) mounting in Professional Mode

 

Specifications

Supported Operating Systems

  • Windows 10
  • Windows 8 (and 8.1)
  • Windows 7
  • Windows Vista
  • Windows XP
  • Windows Server 2016/2019
  • Windows Server 2012 (and R2)
  • Windows Server 2011
  • Windows Server 2010
  • Windows Server 2008 (and R2)
  • Windows Server 2003 (with KB932755)

Supported File Systems

  • FAT 12/16/32
  • NTFS

Experimental support for:

  • Btrfs
  • Ext2/3/4 (except with 64 bit header fields used by some of the latest Linux distributions)
  • ExFAT
  • HFS+
  • SquashFs
  • UDF
  • XFS

Supported Image Formats

  • Raw (dd)
  • Advanced Forensics Format 4 (AFF4)
  • EnCase (E01 and Ex01) if libewf is available
  • Virtual Machine Disk Files (VHD, VDI, XVA, VMDK, OVA) and checkpoints (AVHD, AVHDX) if DiscUtils is available