Image Mounting

Disk images cannot be opened like traditional files, but you can access it either using a forensic tool to analyze its contents or mount the image to view its contents in a file-system view

Mounting

Mounting enables you to view the image as a virtual disk drive

• Mounting is a process in which the operating system makes files and directories on a storage device available to access via the computer's file system
• Unmounting is the opposite process of mounting where the operating system cuts off all access to files and directories on the mount point

Mounting usually views the forensic image in read-only mode to guarantee its integrity

However many tolls allow mounting with writing mode and allow you to make modifications to the image file

These modifications may be saves to the original image or to a cache file to retain the image integrity

So why do we need mounting?

In some cases it is preferable to mount a forensic image file to view and interact with its data using the file system. This makes it easier to:

• Run a third party application, such as antiviruses
• View files via their native applications
• Easily copy files from the mounted image to your machine
• No need to analyze the unallocated space
• Run parsing scripts and searches from windows or Linux

Self Reading

The data is stored in your computer in specific, structured file formats. Defined by the used file system

To interpret the data properly, the computer should be able to recognize and read this format if the computer does not recognize the format, it will return errors

Also, forcing your computer to work with corrupted or unrecognized formats will cause it to write data incorrectly, possibly rendering unrecoverable all the files stored on the media