Announcement

Collapse
No announcement yet.

OSFMount cannot mount dd image from EnCase

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • OSFMount cannot mount dd image from EnCase

    I can mount .dd.0000 images from EnCase with Windows Xp and HFS inside. But if Windows 7 is in image I cannot mount it - partitions are recognizes correctly but the system partition is marked as NTFS or HFS and when is mounted then new explorer says disk is not accessible - end of file. Any idea?

  • #2
    Originally posted by Edas View Post
    I can mount .dd.0000 images from EnCase with Windows Xp and HFS inside. But if Windows 7 is in image I cannot mount it - partitions are recognizes correctly but the system partition is marked as NTFS or HFS and when is mounted then new explorer says disk is not accessible - end of file. Any idea?
    What is in the image file? (List all partitions, size and file system)

    Was the size and offset calculated correctly after you chose the partition?

    After you mounted the partition, does the File System column in the 'Mounted virtual disks' list say 'NTFS' or 'N/A'?

    If the file system is 'N/A', it means that Windows was unable to detect the disk as a valid NTFS file system. If you are sure that the file system isn't corrupted, you can try using our OSForensics product to view the contents of the file system, as we have implemented our own file system layer.

    1) Add the image partition to the case
    2) Open the 'File System Browser'
    3) Select your image partition

    If a valid NTFS file system is contained, you should be able to browse the directory tree.

    Comment

    Working...
    X