Skip to content

dfir-scripts/EverReady-Disk-Mount

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

39 Commits
 
 
 
 

Repository files navigation

EverReady Disk Mount
Mount/umounts disk and disk images (E01, vmdk, vhd(x), vdi, raw, iso, hfs+, qcow2 and vss)

USAGE: $0 [-h -s -u -b -rw] -i Image_file_or_Disk -m Mount_Point -t File_System_Type

OPTIONAL:
       -i Image file or disk source to mount
       -m Mount point (Default /mnt/image_mount)
       -t File System Type (Default NTFS)
       -h This help text
       -s ermount status
       -u umount all disks from $0 mount points
       -b mount bitlocker encrypted volume
       -rw mount image read write

  Default mount point: /mnt/image_mount
  Minimum requirements: ewf-tools, afflib3, qemu-utils, libvshadow-utils, libbde-utils
  Works best with updated drivers from the gift repository (add-apt-repository ppa:gift/stable)
  Warning: forcefully disconnects mounted drives and Network Block Devices
  When in doubt reboot

https://dfir-scripts.medium.com/forensic-mounting-of-disk-images-using-ubuntu-20-04-fe8165fca3eb

Change Log:
Oct 7, 2023
Added command line options for disk_image_file (-i), mount_point (-m) and file_system_type (-t) for faster mounting.

Mar 8, 2022
Changed VHD(x) mount from aff to nbd and improved WSL compatibility

Dec 26, 2021
Updated nbd mount error checking and minor updates

Oct 21, 2021
Added nbd mount if affuse fails Fixed issue that prevented entering partition starting block

Mar 23, 2021
Changed default mount location from /tmp/ermount to /mnt/image_mount
Changed working volume mount locations from /tmp/ to /mnt/
Fixed vsc mount option showing when there are no vscs
Updated status formatting to display nvme and other disk types
Changed vhd(x) mounting to affuse for mounting in WSL

About

Disk Image Mounting Script

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages