Mount Image Pro - Frequently Asked Questions (FAQ)
» What type of images can I mount?
MIP v2: EnCase.E01, FTK.E01, SMART, DD (RAW) and ISO
MIP v3: EnCase.E01, EnCase.L01, FTK.E01, FTK.AD1, SMART, DD (RAW), AFF, VMDK, SafeBack and ISO
» Is it possible to change the contents of a mounted image?
When dealing with forensic computer images always ensure that you have a secure, verified backup copy.
EnCase images cannot be altered by the Mounting Process.
A mounted image may appear to have changed due to the Windows cache. For example, it is possible to save a file to a mounted drive. However, when the image is re-mounted, all changes stored in the Windows cache will be lost.
» My image will not mount, what can I do?
For troubleshooting information on mounting an image,click here.
» How many images can I mount at one time?
The number of images that you can mount is only limited by the number of available drive letters on your system.
» Can images automatically remount when I reboot?
Yes. In OPTIONS / GENERAL place a tick in the box for "Auto mount after System Reboot"
» The mounted drive says that is needs to be formatted?
No partitions were found on the drive, so Windows thinks it is a drive letter that is yet to be formatted. This does not mean that the image is blank. Try a program like Recover My Files (www.recovermyfiles.com) to scan the mounted drive for data.
» Can I mount non-Windows file systems like MAC or LINUX?
Yes. It is possible to mount non-Windows file systems, however you will need to pre-install the appropriate file system driver. Click here for more information.
» Should I mount as a drive letter or as a "single" drive?
Mounting as a drive letter gives access to partitions inside the image. Mounting as a single drive gives access to the entire physical drive. Click here to learn more.
» Will I be able to see all data inside the mounted image?
Access to information inside a mounted image is controlled by Windows. When examining a mounted image you should be logged on to the computer as Administrator. You should also ensure that the necessary folder permissions are set to allow you to see the full contents of each folder. Read more information about folder permissions here.
» Can I run third party tools over the mounted image?
Yes. This is one of the primary reasons for using Mount Image Pro. You can run tools like:
- data recovery programs (eg. Recover My Files from www.recovermyfiles.com)
- virus scanners
- spyware programs
- stenography programs etc.
» Can I boot a mounted image using VMWare?
It is possible to boot a forensic image using GetData's Forensic Explorer and virtualization software such as VMWare or VirtualBox. Learn more at http://www.forensicexplorer.com/live-boot.php.