Mount Image Pro - Frequently Asked Questions (FAQ)

Frequently Asked Questions

  • What type of images can I mount?
  • Is it possible to change the contents of a mounted image?
  • My image will not mount, what can I do?
  • How many images can I mount at one time?
  • Can images automatically remount when I reboot?
  • The mounted drive says that is needs to be formatted?
  • Can I mount non-Windows file systems like MAC or LINUX?
  • Should I mount as a drive letter or as a "single" drive?
  • Will I be able to see all data inside the mounted image?
  • Can I run third party tools over the mounted image?
  • Can I boot a mounted image using VMWare?

What type of images can I mount?

MIP v2: EnCase.E01, FTK.E01, SMART, DD (RAW) and ISO

MIP v3: EnCase.E01, EnCase.L01, FTK.E01, FTK.AD1, SMART, DD (RAW), AFF, VMDK, SafeBack and ISO

Is it possible to change the contents of a mounted image?

When dealing with forensic computer images always ensure that you have a secure, verified backup copy.

EnCase images cannot be altered by the Mounting Process.

A mounted image may appear to have changed due to the Windows cache. For example, it is possible to save a file to a mounted drive. However, when the image is re-mounted, all changes stored in the Windows cache will be lost.

My image will not mount, what can I do?

For troubleshooting information on mounting an image,click here.

How many images can I mount at one time?

The number of images that you can mount is only limited by the number of available drive letters on your system.

Can mounted images automatically be remounted when I reboot?

Yes. In OPTIONS / GENERAL place a tick in the box for "Auto mount after System Reboot"

When I open a mounted drive is says that is needs to be formatted?

No partitions were found on the drive, so Windows thinks it is a drive letter that is yet to be formatted. This does not mean that the image is blank. Try a program like Recover My Files (www.recovermyfiles.com) to scan the mounted drive for data.

Can I mount a non-Windows file system like MAC or LINUX?

Yes. It is possible to mount non-Windows file systems, however you will need to pre-install the appropriate file system driver. Click here for more information.

What is the difference between mounting as a drive letter or as a "single" drive?

Mounting as a drive letter gives access to partitions inside the image. Mounting as a single drive gives access to the entire physical drive. Click here to learn more.

Will I be able to see all data inside the mounted image?

Access to information inside a mounted image is controlled by Windows. When examining a mounted image you should be logged on to the computer as Administrator. You should also ensure that the necessary folder permissions are set to allow you to see the full contents of each folder. Read more information about folder permissions here.

Can I run third party tools over the mounted image?

Yes. This is one of the primary reasons for using Mount Image Pro. You can run tools like:

  1. data recovery programs (eg. Recover My Files from www.recovermyfiles.com)
  2. virus scanners
  3. spyware programs
  4. stenography programs etc.

Can I boot a mounted image using VMWare?

A third party tool called Virtual Forensic Computing (VFC) is required to boot mounted images. VFC was developed by:
Michael A. Penhallurick
RMCS Forensic Computing MSc 2002-2005 Cranfield University

LiveView:"Live View is a Java-based graphical forensics tool that creates a VMware virtual machine out of a raw (dd-style) disk image or physical disk. This allows the forensic examiner to "boot up" the image or disk and gain an interactive, user-level perspective of the environment, all without modifying the underlying image or disk."

Can u contribute to this FAQ? Please contact using the email link on this page.