
imagemounter
#Incident Management#Digital Forensics
A tool with advanced filtering capabilities for analyzing events based on time, path, weekday, and date.
imagemounter: A Command-Line Utility for Disk Image Management
imagemounter is a command-line utility and Python package designed to simplify the process of mounting and unmounting various disk image formats, including EnCase, Affuse, vmdk, and dd, as well as other formats supported by compatible tools.
Support for Mounting Disk Images and More
It supports mounting disk images using xmount (with an optional RW cache), affuse, ewfmount, and vmware-mount. It can detect various volume systems, including DOS, BSD, Sun, Mac, and GPT. Additionally, it mounts FAT, Ext, XFS, UFS, HFS+, LUKS, and NTFS volumes, along with some lesser-known filesystems. It also identifies (nested) LVM volume systems and mounts their subvolumes, as well as reconstructs Linux Software RAID arrays. In its default mode, imagemounter attempts to mount the base image on a temporary mount point. It first detects the volume system and then mounts each volume separately. If it fails to identify a volume system, it will attempt to mount the entire image as a whole if it successfully determines its type.
This package is compatible with Python 3.6 and above
A very basic example of a valid mount is provided below:
The command-line utility offers additional features
The command-line utility offers many more features; however, the results can vary significantly based on the specific type of disk you are attempting to mount: # imount lvm_containing_dos_volumesystem_containing_ext4