I've Cloned but I'm not sure what to Mount

[janedough]

Hi. First of all THANK YOU for such a great program! I'm completely new to all of this, but I'm not new to IT in general. That's why I'm having such a hard time grasping that I can't seem to figure this out.

I cloned an XP laptop using OSFClone. Cloned the complete drive to an external hard drive. I plugged that into my computer and I see that the E drive is now called "Acer" and that there are indeed files and folder in that drive that seem like they should be there. I have a folder called i386 and one called WINDOWS that are dated with yesterday's date. Which is when I cloned the laptop. The rest of the files and folders, including a hidden one called ACER, are dated from as far back as 2009. So, when I open up OSFMount, I have no idea what to mount. I didn't do an image of the drive, so I assume I'm not looking for an .iso file.

Please feel free to laugh and such. I know the answer must be so easy. But I don't even know where to start without reformatting my external drive and starting again. I'll do it if I have to. But I really don't want to.

Thanks for any help you can give!

[David (PassMark)]

When you copy a drive there are two high level options.

- You can copy the entire drive to another physical drive. In which case you can then just plug in the drive and use it without any special software. Doing this will destroy an pre-existing data on the destination drive. It might also waste space on the destination drive if the destination is larger than the source.

OR

- You can copy the entire drive to a single file on another disk. In this case the destination drive needs to be already formatted and no existing data is destroyed. In this case the destination file is called a image file. Commonly used file extensions are .iso, .dd, .img, etc..
In this case you need to 'mount' the large image file in order to view the original files from the source disk. OSFMount can be used for this.

[janedough]

Aha! I did the first option. So what you're saying is when I do this there is no need to use OSFMount? I just want to be sure. I won't go that route in the future, but since I have the cloned drive now I want to proceed with my practice. I just need to use OSForensics on this external drive as if it were a normal part of my laptop. If I'm wrong about that, please let me know.

Thanks so much for your swift reply! You've spared me from losing sleep worrying about it.

When you copy a drive there are two high level options.

- You can copy the entire drive to another physical drive. In which case you can then just plug in the drive and use it without any special software. Doing this will destroy an pre-existing data on the destination drive. It might also waste space on the destination drive if the destination is larger than the source.

OR

- You can copy the entire drive to a single file on another disk. In this case the destination drive needs to be already formatted and no existing data is destroyed. In this case the destination file is called a image file. Commonly used file extensions are .iso, .dd, .img, etc..
In this case you need to 'mount' the large image file in order to view the original files from the source disk. OSFMount can be used for this.

[David (PassMark)]

Yes, no need to OSFMount if you took the 1st option.

[janedough]

Thanks so much for your help!