OSFMount allows the analysis of disk images with PassMark OSForensics. OSFMount can be used to mount image files that were created using a disk cloning application (such as OSFClone). The image file is mounted as a virtual drive on Windows, which can then be analyzed using OSForensics. By default, the image files are mounted as read-only so that the original image files are not altered.
OSFMount supports the following image formats:
- Raw Images (IMG, DD)
- Raw CD/DVD/Blu-ray Images (ISO, BIN)
- Split raw Images (Eg. raw_split.001, raw_split.002, raw_split.003)
- Nero Burning ROM Images (NRG)
- System Deployment Images (SDI)
- Advanced Forensics Format Images (AFF, AFD, AFM)
- VMWare Images (VMDK)
- EnCase/SMART Images (.E01/.S01)
The files and folders contained in images mounted by OSFMount can be accessed normally in Windows as long as the image contains a valid file system. Otherwise, Windows will prompt the user to format the drive.
Mounting images in OSFMount can also provide many performance benefits to the user. Mounting CD ISO images can be useful when a particular CD is used often and the speed of access is important. OSFMount also supports mounting image files as RAM disks. This generally has a large speed benefit over using a hard disk. As such, this is useful with applications requiring high speed disk access (such as database applications, games and browsers). A second advantage is security, as the disk contents are not stored on a physical hard disk (but rather in RAM), allowing the contents to be destroyed on system shutdown.
OSFMount - 64bit software