For years, leading practitioners have relied on Arsenal Image Mounter. A tool that transformed their ability to process data and see things differently. It’s opened up the ability to create new investigative tools and find critical evidence saving valuable time and resources. In some cases, smoking-gun evidence was retrieved that many thought improbable or may have never been found at all. 

In 2012, we had a number of cases requiring software that didn’t exist. We needed a way to programmatically rebuild Registries from previous Windows installations which led us to the concept of ingesting as much Registry data as possible from a forensic disk image and then showing our customers how a Registry (or, Registries) changed over time. Essentially, we gained access to an enormous volume of Registry data which has been effectively deleted. We called it Registry Recon. 

There was one major problem we faced. Many Windows®-based disk image mounting solutions mount the contents of disk images as shares or partitions. We needed to access complete (a/k/a “physical” or “real”) disks in which the contents of disk images are complete disks. As far as Windows is concerned, the contents of disk images needed to be real SCSI disks, allowing us to benefit from disk-specific features. We solved that problem by developing our own image disk mounting tool, Arsenal Image Mounter.

Over the years, we developed other tools like our Hybernation Recon tool, which exploits Windows hibernation files to “look back in time” and uncover compelling evidence is crucial to digital forensics practitioners. 

Meanwhile, we continued to build upon Arsenal Image Mounter, adding new features here and there to meet our own needs. What we didn’t see in the beginning was a potential game changing software.

From out of our own needs and challenges, we built a tool that would become a must-have go-to tool for digital forensic practitioners. We always wanted to share this tool with other practitioners and software developers facing the same road-blocks and pain-points we faced, so we offered it for free. 

Eventually, as we started to invest more resources to add new and more sophisticated features, we released a Professional Version that includes some truly fascinating features, such as:

  • Effortlessly launch (and often login to) virtual machines
  • Volume Shadow Copy mounting with optional Windows NTFS driver bypass
  • Windows file system driver bypass support for disk image mounting
  • Virtually mount archives and directories
  • Save disk images with fully-decrypted BitLocker volumes

Are you ready to use Arsenal Image Mounter Pro? 

With an Arsenal Recon subscription you will get the full power and features of Arsenal Image Mounter. In addition, you will receive access to all of Arsenal’s complete collection of digital forensic tools. With tools such as Registry Recon and Hibernation Recon, you will have the opportunity to provide deep insights into digital forensic evidence and investigation. 

Save ~25% before September 1st on a professional subscription.*

Subscription pricing before September 1st, 2020

1 Month1 Year3 Years5 Years
$49$570$1,605$2,499

Pricing increase on September 1st

1 Month1 Year3 Years5 Years
$65$756$2,129$3,315

An Arsenal Subscription includes access to all Arsenal digital forensic tools. You gain access to some of the most advanced tools of their kind:

  1. Arsenal Image Mounter
  2. Registry Recon
  3. Hibernation Recon
  4. HBIN Recon
  5. Hive Recon
  6. ODC Recon

Save Today! Prices increase on September 1st, 2020.

 

 

Want to try it out first? No problem. Download the free version.

Still not convinced?

After many unsuccessful attempts to launch forensic images into virtual machines with a popular digital forensics tool, I decided to give Arsenal Image Mounter a try. I’m very glad I did, because I was able to virtualize forensic images from multiple suspects. AIM also bypassed Microsoft cloud account passwords within the virtual machines, so I was able to take valuable screenshots for the US Attorney. In addition, I have found AIM’s multiple methods of Volume Shadow Copy exporting to be useful.


ICE/Homeland Security Investigation

Read our testimonies and FAQs.