Many Windows®-based disk image mounting solutions mount the contents of disk images as shares or partitions, rather than complete (a/k/a “physical” or “real”) disks, which limits their usefulness to digital forensics practitioners and others. Arsenal Image Mounter mounts the contents of disk images as complete disks in Windows, allowing users to benefit from disk-specific features like integration with Disk Manager, launching virtual machines (and then bypassing Windows authentication and DPAPI), managing BitLocker-protected volumes, mounting Volume Shadow Copies, and more.
Arsenal Image Mounter Features
Arsenal Image Mounter is available in Free Mode and Professional Mode.
Free Mode
Features- Mount raw, forensic, and virtual machine disk images as complete (a/k/a “real”) disks on Windows
- Temporary write support with replayable delta files for all supported disk image formats
- Save “physically” mounted objects to various disk image formats
- Virtually mount optical images
- RAM disk creation with either static or dynamic memory allocation
- Command-line interface (CLI) executables
- MBR injection, fake disk signatures, removable disk emulation, and much more
Professional Mode
Features- Effortlessly launch virtual machines from disk images
- Extremely powerful Windows authentication and DPAPI bypass within virtual machines
- Volume Shadow Copy mounting (standard, with Windows NTFS driver bypass, or as complete disks)
- Launch virtual machines directly from Volume Shadow Copies
- Windows file system driver bypass (FAT, NTFS, ExFAT, HFS+, Ext2/3/4, etc.)
- Exposure of NTFS metadata, slack, and unallocated in Windows file system driver bypass mode
- Virtually mount archives and directories
- Save disk images with fully-decrypted BitLocker volumes
Watch Arsenal Image Mounter Demonstrations
Launching a BitLockered Disk Image into a Virtual Machine
Launching VSCs from a SANS Domain Controller into VMs
Are you ready to use Arsenal Image Mounter Pro?
Arsenal Image Mounter Pro is available with an Arsenal subscription, which includes access to the full functionality of all our tools.
Even our testimonials are powerful!
“I had a disk image obtained from a Windows server’s 4TB RAID array that failed to launch into a virtual machine using my existing tools and methods. I needed the server running in a virtual machine because it hosted an important CRM application. I also had disk images from Windows workstations which ran the CRM client. While I had used Arsenal Image Mounter’s (AIMs) Free Mode functionality in the past, I was unaware of its Professional Mode capabilities until this case. AIM allowed me to mount the server’s disk image in write-temporary mode (so changes to the operating system and applications could be made without altering the original evidence) and launch the virtual machine – with just a few button presses!
I finally had the server running in a virtual machine… but I was at a login screen and did not have a password. Not a problem – AIM’s Windows authentication bypass allowed me to get right into the server. In order to get the CRM application working, I also launched the Windows workstations into virtual machines using AIM’s isolated networking (only between virtual machines) option. At this point, the CRM clients on the workstations connected to the CRM on the server and my team was able to access the data we needed for our case.
I have since recommended AIM to the other members of my team, and I foresee I’ll be using the virtual machine launching and Windows authentication bypassing functionality a lot more often.”
Read more testimonials.
Unleash Arsenal Image Mounter Pro Now!
Want to try AIM first? No problem.
Download AIM now and use its free functionality, or email us for an evaluation license which unlocks Professional Mode.