Arsenal Image Mounter

Arsenal

Image Mounter

Reliable. Powerful. Trusted.

Easily Launch Virtual Machines from Disk Images

And much, much more...

Many Windows®-based disk image mounting solutions mount the contents of disk images as shares or partitions, rather than complete (aka "physical or "real") disks, which limits their usefulness to digital forensics practitioners and others. Arsenal Image Mounter mounts the contents of disk images as complete disks in Windows, allowing users to benefit from disk-specific features like integration with Disk Manager, launching virtual machines (along with Windows authentication, DPAPI, and S Mode bypasses), managing BitLocker-protected volumes, mounting Volume Shadow Copies, and more.

See Arsenal Image Mounter In Action

Become more familiar with AIM's powerful functionality by watching our demonstrations.

Demonstrating VM launch from Surface Pro 5 connected via PALADIN v9.3.2 and AIM Remote Agent
Demonstrating VM launch from Dell Laptop Connected via PALADIN and AIM Remote Agent on Windows x64
Watch More

Arsenal Image Mounter Features

Arsenal Image Mounter includes both free (Free Mode) and paid (Professional Mode) features.

Features Available in Free Mode

  • Mount raw, forensic, and virtual machine disk images as complete (a/k/a “real”) disks on Windows

  • Temporary write support with replayable differencing files for all supported disk image formats

  • Save "physically" mounted objects to various disk image formats

  • Identify (with details), unlock, fully decrypt, and disable/suspend BitLocker-protected volumes

  • Access disks, volumes, and Volume Shadow Copies as virtual dd files (and disks as virtual VHDX files)

  • Virtually mount optical images

  • RAM disk creation with either static or dynamic memory allocation

  • Virtually mount archives

  • Command-line interface (CLI) executables and PowerShell modules (for Command Prompt and PowerShell, respectively)

  • MBR injection, fake disk signatures, removable disk emulation, and much more

Features Available in Professional Mode

  • Effortlessly launch virtual machines from disk images, actual physical disks, and remotely-connected disks

  • Extremely powerful Windows authentication, DPAPI, and S Mode bypasses within virtual machines

  • Linux password bypass within virtual machines

  • Database-driven Windows password attack (including Arsenal's "Password Sledgehammer") within virtual machines

  • Multiple methods of Volume Shadow Copy mounting (standard, with Windows NTFS driver bypass, or as complete disks)

  • Launch virtual machines directly from Volume Shadow Copies

  • Attach to actual physical disks (fixed and removable) to leverage virtual machine launching, VSC mounting, etc.

  • Write mounted disk images to physical disks with optional free space clearing

  • Windows file system driver bypass (FAT, NTFS, ExFAT, HFS+, Ext2/3/4, etc.)

  • Exposure of NTFS metadata, slack, and unallocated in Windows file system driver bypass mode

  • Virtually mount directories

  • Save disk images with fully-decrypted BitLocker volumes

  • Recon Reports containing valuable information about disk images (and actual physical disks) useful for triage

  • Connect to remote disks over a network with AIM Remote Agent

Latest Features
FAQs

Our Testimonials Are Compelling!

Get Lucky Instantly

"Arsenal Image Mounter has been very useful in a variety of my cases now, especially for password exfiltration, but also for launching applications 'from the suspects point-of-view'. Additionally AIM Remote Agent has helped me uncover passwords in time-critical cases. With AIM Remote Agent I did not have to image disks first, but was able to launch computers as virtual machines across a secure network and get lucky instantly."

Mario
Law Enforcement (Austria)

Voodoo Forensics

"I recently used Arsenal Image Mounter in a complex fraud case to virtualize a forensic image from a Windows computer. Having the ability to bypass the Windows password made this a simple process and allowed me to demonstrate to my client how the Windows environment looked to the user at the time the forensic image was obtained. My client (an attorney) was very happy with this and I created visuals for use as exhibits. Later, we had cause to look at the Volume Shadow Copies (VSCs) to see how a particular document’s content changed over time. AIM allowed me to launch the VSCs into virtual machines, again bypassing passwords. My client was stunned that he could see how the document looked over time just as the user had seen it, and asked if this was voodoo forensics! Leveraging VSCs launched into virtual machines was crucial to this matter and was very jury friendly. In my long career in this field, I have seen only a few tools that have had such an impact on a case. AIM’s ability to launch VSCs into virtual machines along with Windows authentication bypass is the result of some amazing work that the talented people at Arsenal have done over the years. If you are involved in digital forensics, AIM should be in your toolkit."

David Greetham
VP of Digital Forensics, Level Legal

More Testimonials

Unleash Arsenal Image Mounter Pro

Buy an Arsenal license and choose a subscription length (see the increasing discounts!) that works best for you. Want to try AIM first? Download AIM now and use its free functionality, or email sales to evaluate Professional Mode.

1 Year Plan
$907
~ $75/mo | Save 0%

    • Email Support

    • Purchase Annually

    • No Discount

Buy Now

3 Year Plan

$2,448

~ $68/mo | Save 9%

5 Year Plan

$3,840

~ $64/m | Save 14%

View Pricing & Plan Details
Prices shown in USD and without tax.