OFS Mount File with Muliple Partition

[Viralp]

Hi,

I want to map drive included with multiple partitions, how can i do that?
we are using below command line syntax to mount,

OSFMount.com -a -t file -f "FilePath" -m #:

can you suggest, what can I update to mount all partitions in a single command?


Thanks

[David (PassMark)]

You are using -f "FilePath", but what type of file is this? How was it created?

There is a -v option to select the partition.

-v partition
Specifies which partition (1-based) to mount when mounting a raw hard disk image
file containing a master boot record and partitions.
You can specify '#' to automatically select the first detected partition.
If this option is not specified, the entire image shall be mounted using physical emulation.

[Viralp]

Hi David,

Thanks for the response.

We are using encase file (E01), i.e -f "C:\Demo.E01".

We have already tried -v option but it requires partition number and we want to mount all the partition in one command.

So please provide your views on the same.

Regards

[David (PassMark)]

Instead of mounting partitions as volumes, you should be able to mount the entire E01 as a physical drive.
(emulated physical drive of course)

[Viralp]

Hi David,

We had also tried it and we have done it using below command :

OSFMount.com -a -t file -f "C:\Demo1.E01" -o physical

And we are getting below output :

Creating device...
Error creating virtual disk:
A device attached to the system is not functioning.

[David (PassMark)]

Are you running your command prompt as the elevated admin user?
Can you mount the same image from the normal Graphical User Interface as physical drive?

[Viralp]

Yes David, we are running the command prompt as Administrator.

and we have also tried the same using normal Graphical User Interface and we are receiving the same error there as well.

[David (PassMark)]

Might be something wrong or unexpected with the image file. If you would like to share the E01 image file we can have a deeper look at it.

Otherwise you could try can try using a batch script to mount multiple partitions.
The GUI also allows you to select multiple partitions to mount at once

[Viralp]

David,

Can you please help us with the batch script ?

Actually, the problem is we does not know upfront that howmayn number of partitions are there in image and we can't use the GUI tools for it.

so we need something from which we can mount all the partition of the image in one go.

[Viralp]

Hi Team,

any update for above concern.

Thanks

[Viralp]

if there no other workaround except putting Partition number in command line, how do we know if selected file having multiple partition in it, how to assign them with partition number, if you have any idea please us on same.

Thanks

[David (PassMark)]

If you would like to share the E01 image file we can have a deeper look at it.

[Viralp]

Hi David,

As the original file has 200 GB size and client file, so not able to share that file with you.
I have asked our IT team to create a similar file for multiple partition issue.

File has 14 Gb size, you can access it from below FTP account.

FTP site :

https://sftp.in.knovos.com Account Name : DmitryS Password: S32wae43@7@#1 There would be one folder Name : Knovos Please note this FTP location is up for 2 days ONLY. if you process this file with Uitility UI for mount single drive with Logical or Physical drive option it gives error as below, Creating device... Error creating virtual disk: A device attached to the system is not functioning. please guide how to execute command line version to mount this file in a single command. Thanks

[David (PassMark)]

That Indian knovos.com site is fairly slow to the point of being unusable. What should have been a 30min download took 8 hours. But I think we got all the files in the end.
We'll have a look at them next week.

[keith]

We tried the following command to mount your image as a physical drive, but wasn't able to reproduce the error.

osfmount.com -a -t file -f "E:\images\Encase Image 16GB.E01" -o physical

We also tried mounting as a logical drive, but it also mounted properly.

osfmount.com -a -t file -f "E:\images\Encase Image 16GB.E01" -v 1 -m #:
osfmount.com -a -t file -f "E:\images\Encase Image 16GB.E01" -v 2 -m #:

Are you using the latest OSFMount from this page:
https://www.osforensics.com/tools/mo...sk-images.html