Making maximum exploitation of electronic evidence more accessible.Learn More
Arsenal Image Mounter mounts the contents of disk images as complete (a/k/a "physical" or "real") disks in Windows®, allowing users to benefit from disk-specific features like integration with Disk Manager, launching virtual machines (and then bypassing Windows authentication and DPAPI), managing BitLocker-protected volumes, mounting Volume Shadow Copies, and much, much, more.
Mounting disk images as "real" disks
Attaching physical disks with replayable delta files
Effortlessly launching virtual machines
Bypassing Windows authentication & DPAPI
Bypassing Windows file systems drivers
Mounting Volume Shadow Copies
Exposing disks and disk images as virtual dd files
Interacting with BitLocker-protected volumes
Hibernation Recon supports active memory reconstruction from Windows XP, Vista, 7, 8/8.1, and 10 hibernation files and also extracts massive volumes of information from the multiple types (and levels) of slack space that often exist within them. Additional features of Hibernation Recon include the automatic recovery of valuable NTFS metadata and parallel processing of multiple hibernation files.
Registry forensics has long been relegated to analyzing only readily accessible Windows Registries, often one at a time, in a time-consuming way. Registry Recon is not just another Registry parser. Arsenal developed powerful new methods to parse Registry data so that Registries which have existed on a Windows system over time can be rebuilt, providing unique insignt into how Registry data has changed over time.
Each of our subscription options includes access to all the Arsenal tools, both those that exist now and those we release while the subscription is active! Pick the subscription that works for you without the hassle of maintenance fees.
Arm yourself with updates about Arsenal tools, training, and research. Our mailing list is double opt-in so you will need to check your email and confirm your subscription before receiving our mailings.