OSFMount: access denied to parts of disk image

[ah21]

Hello,

I made a raw disk image with safecopy under Windows 7 64bit, of a ~460 GB ntfs partition. It is has some non-recovered parts, but most data is there. OSFMount mounts it and everything seems fine. However when I try to access certain folders, (e.g. \Users\username\My Documents\ ) then I get denied access, first the error is that administrator access is necessary, but then when I click on the field to give admin access and continue, access is still blocked. I know that the folders I tried to access are successfully recovered, because when I mount it under linux I can access them. This might also be something about windows access control or something, not sure. Any ideas what this is and how to work around it are appreciated.

[David (PassMark)]

Yes, it is a consequence of Windows access control.

There are a couple of alternatives.

1) You mount the image without the read only flag checked. Then you can change the folder permission from within Windows. But if you are doing this for forensics reasons you might not want to do this.

2) You read the disk image directly in our OSForensics software without mounting the image to a drive letter. You can then access all files by passing file permissions. You won't see the disk in Windows Explorer in this case, but will be able to browse it and copy files using OSF.