Arsenal Image Mounter

Arsenal

Image Mounter

Reliable. Powerful. Trusted.

Easily Launch Virtual Machines from Disk Images

And much, much more...

Many Windows®-based disk image mounting solutions mount the contents of disk images as shares or partitions, rather than complete (aka "physical or "real") disks, which limits their usefulness to digital forensics practitioners and others. Arsenal Image Mounter mounts the contents of disk images as complete disks in Windows, allowing users to benefit from disk-specific features like integration with Disk Manager, launching virtual machines (along with Windows authentication, DPAPI, and S Mode bypasses), managing BitLocker-protected volumes, mounting Volume Shadow Copies, and more.

See Arsenal Image Mounter In Action

Become more familiar with AIM's powerful functionality by watching our demonstrations.

Demonstrating Arsenal Image Mounter launching a virtual machine from a Linux laptop (safely booted with WinFE) connected across a network via AIM Remote Agent
Demonstrating Arsenal Image Mounter (running on Windows on Arm) identifying possible passkey usage during a virtual machine launch (Launch VM options screen) and in the Recon Report
Watch More

Arsenal Image Mounter Features

Arsenal Image Mounter includes both free (Free Mode) and paid (Professional Mode) features.

Features Available in Free Mode

  • Mount raw, forensic, and virtual machine disk images as complete (a/k/a “real”) disks on Windows

  • Temporary write support with replayable differencing files for all supported disk image formats

  • Save "physically" mounted objects to various disk image formats

  • Identify (with details), unlock, fully decrypt, and disable/suspend BitLocker-protected volumes

  • Access disks, volumes, and Volume Shadow Copies as virtual dd files (and disks as virtual VHDX files)

  • Virtually mount optical images

  • RAM disk creation with either static or dynamic memory allocation

  • Virtually mount archives

  • Command-line interface (CLI) executables and PowerShell modules (for Command Prompt and PowerShell, respectively)

  • MBR injection, fake disk signatures, removable disk emulation, and much more

Features Available in Professional Mode

  • Effortlessly launch virtual machines from disk images, actual physical disks, and remotely-connected disks

  • Extremely powerful Windows authentication, DPAPI, and S Mode bypasses within virtual machines

  • Linux password bypass within virtual machines

  • Database-driven Windows password attack (including Arsenal's "Password Sledgehammer") within virtual machines

  • Multiple methods of Volume Shadow Copy mounting (standard, with Windows NTFS driver bypass, or as complete disks)

  • Launch virtual machines directly from Volume Shadow Copies

  • Attach to actual physical disks (fixed and removable) to leverage virtual machine launching, VSC mounting, etc.

  • Write mounted disk images to physical disks with optional free space clearing

  • Windows file system driver bypass (FAT, NTFS, ExFAT, HFS+, Ext2/3/4, etc.)

  • Exposure of NTFS metadata, slack, and unallocated in Windows file system driver bypass mode

  • Virtually mount directories

  • Save disk images with fully-decrypted BitLocker volumes

  • Auxiliary BitLocker volume auto unlock

  • Recon Reports containing valuable information about disk images (and actual physical disks) useful for triage

  • Connect to remote disks over a network with AIM Remote Agent

Latest Features
FAQs

Our Testimonials Are Compelling!

Simplifies and Streamlines

“Arsenal Image Mounter’s (AIM’s) new auxiliary BitLocker volume auto-unlock functionality simplifies and streamlines auto-unlocking BitLocker volumes on both internal and external drives while maintaining the highest forensic standards. AIM’s ability to also identify all the previously attached and automatically unlocked auxiliary BitLocker volumes on Windows will greatly assist in identifying missing pieces for investigations that may have been otherwise overlooked.”

Digital Forensic Analyst
Law Enforcement (Australia)

Literally Point and Click

“We recently had several challenging BitLocker-protected devices where we reached out to Arsenal for assistance. They allowed us an internal build of Arsenal Image Mounter (AIM) with new “auxiliary BitLocker volume auto-unlock functionality" to test against a device. This allowed us to save a significant amount of time accessing a suspect’s internal drives protected with BitLocker’s automatic unlock feature… literally point and click! Where BitLocker is becoming an everyday issue for us, we have now purchased Arsenal licences allowing us save significant amounts of time and gain early access to protected devices with AIM. We have additionally used the very efficient DPAPI bypass function (and Password Sledgehammer) during virtualisation on several occasions, primarily to recover saved browser credentials from across a number of platforms. This has allowed the building of custom wordlists in line with device owners password habits. Arsenal have been extremely responsive when asked for support, giving bespoke advice on a number of occasions. This tool is invaluable for anyone having to deal with BitLocker or virtualisation on a regular basis."

Digital Forensic Investigator
Law Enforcement (UK)

More Testimonials

Unleash Arsenal Image Mounter Pro

Buy an Arsenal license and choose a subscription length (see the increasing discounts!) that works best for you. Want to try AIM first? Download AIM now and use its free functionality, or email sales to evaluate Professional Mode.

1 Year Plan
$907
~ $75/mo | Save 0%

    • Email Support

    • Purchase Annually

    • No Discount

Buy Now

3 Year Plan

$2,448

~ $68/mo | Save 9%

5 Year Plan

$3,840

~ $64/m | Save 14%

View Pricing & Plan Details
Prices shown in USD and without tax.