I can mount .dd.0000 images from EnCase with Windows Xp and HFS inside. But if Windows 7 is in image I cannot mount it - partitions are recognizes correctly but the system partition is marked as NTFS or HFS and when is mounted then new explorer says disk is not accessible - end of file. Any idea?
Announcement
Collapse
No announcement yet.
OSFMount cannot mount dd image from EnCase
Collapse
X
-
Originally posted by Edas View PostI can mount .dd.0000 images from EnCase with Windows Xp and HFS inside. But if Windows 7 is in image I cannot mount it - partitions are recognizes correctly but the system partition is marked as NTFS or HFS and when is mounted then new explorer says disk is not accessible - end of file. Any idea?
Was the size and offset calculated correctly after you chose the partition?
After you mounted the partition, does the File System column in the 'Mounted virtual disks' list say 'NTFS' or 'N/A'?
If the file system is 'N/A', it means that Windows was unable to detect the disk as a valid NTFS file system. If you are sure that the file system isn't corrupted, you can try using our OSForensics product to view the contents of the file system, as we have implemented our own file system layer.
1) Add the image partition to the case
2) Open the 'File System Browser'
3) Select your image partition
If a valid NTFS file system is contained, you should be able to browse the directory tree.
Comment