Arsenalimage mounter

Arsenal Image Mounter mounts the contents of disk images as complete disks in Microsoft Windows. Arsenal Image Mounter includes a virtual SCSI adapter (via a unique Storport miniport driver) which allows users to benefit from disk-specific features in Windows like integration with Disk Manager, access to Volume Shadow Copies, and more. As far as Windows is concerned, the contents of disk images mounted by Arsenal Image Mounter are "real" SCSI disks. Arsenal Image Mounter is the first and only open source solution for mounting the contents of disk images as complete disks in Windows.

Many image mounting solutions mount the contents of disk images in Windows as shares or partitions (rather than complete disks), which limits their usefulness. While developing the digital forensics tool Registry Recon, Arsenal found existing image mounting solutions lacking and built Arsenal Image Mounter. Ongoing development of Arsenal Image Mounter has broader goals which benefit the entire information technology community in addition to digital forensics and incident response practitioners.



Specifications

Supported Operating Systems

  • Windows 8 (and 8.1)
  • Windows 7
  • Windows Vista
  • Windows Server 2012 (and R2)
  • Windows Server 2011
  • Windows Server 2010
  • Windows Server 2008 (and R2)
  • Windows Server 2003 (with KB932755)

Supported File Systems

  • Any filesystem with a driver installed is supported
  • NTFS, FAT32, ReFS, exFAT, HFS+, UFS, and EXT3 have all been tested

Supported Image Formats

  • Raw (dd)
  • EnCase (E01… if libewf is available)
  • Virtual Machine Disk Files (VHD, VDI, XVA, VMDK… if discutils is available)

Use and License

Arsenal Image Mounter is currently geared towards digital forensics and incident response developers, but we have released a sample GUI and command line mount/management utility known as "MountTool" as a proof of concept. We have heard that others in the DFIR community are already building better GUIs and extending the functionality of Arsenal Image Mounter, which is exactly what we had hoped for when we decided to release Arsenal Image Mounter under a dual license. While the DFIR community is excited about the ability to mount the disks within forensic images as physical disks under Windows, there are many more exciting possibilities.

Arsenal Image Mounter's Storport miniport driver is written in C and its user mode API library is written in VB.NET, which facilitates easy integration with .NET 4.0 applications.

We chose a dual license for Arsenal Image Mounter to allow its royalty-free use by open source projects, but require financial support from commercial projects.

Now for the legal stuff… Arsenal Consulting, Inc. (d/b/a Arsenal Recon) retains the copyright to the Arsenal Image Mounter source code being made available under terms of the Affero General Public License v3. (http://www.fsf.org/licensing/licenses/agpl-3.0.html). This source code may be used in projects that are licensed so as to be compatible with AGPL v3.

Contributors to Arsenal Image Mounter must sign the Arsenal Contributor Agreement ("ACA"). The ACA gives Arsenal and the contributor joint copyright interests in the code.

If your project is not licensed under an AGPL v3 compatible license, contact us directly regarding alternative licensing.


The Future

Read/write, Plugins, Shell Integration, iSCSI, AoE, Mounting over HTTP...