OSFMount V1.5 (1015) 64x broken?

[DaleJack]

After this latest Microsoft Patch Tuesday, all of my Windows 7 64X machines won't function with OSFMount. The disk mounts but the drive either reads as empty or a pop up comes up and says it needs formatting. Smallish disk images, 50G or so. Does it on all of them.

And I see the downloads here don't work.

Anyone else having this issue?

[David (PassMark)]

Microsoft broke Windows with the latest patch. It has been widely reported and Microsoft put out a patch to fix their patch, but there is also a manual process to fix it.

See,
http://www.tweaktown.com/news/41896/...are/index.html

[DaleJack]

Doesn't work I'm afraid David. The patch itself doesn't exist on my machines, but they are up to date. Same issue. Mounts the drive but nothing visible. Multiple machines.

D

[David (PassMark)]

The above problem covered a specific issue where everything was working prior to 10/Dec/2014, then stopped working on the 11/Dec (or 12/Dec) when the Microsoft patch was rolled out.

But there are other issues which might result in the image files not being visible once mounted. For example maybe the file system isn't one Windows knows about. (Maybe from a Linux or Mac system)

Is there anywhere we can download the image to take a look at it?

[DaleJack]

It does work on smaller images. I created a couple for testing purposes to send to you but they work so no point. I'll size up and see what happens. (Same issue with a 500GB image, just tested)

[David (PassMark)]

How are you making the images?
What format are they in?
What file system is within the image (NTFS, FAT32, etc..)?

[DaleJack]

X-Ways Forensics V18 SR-2 created those two images. NTFS and NTFS. I'm doing some testing today using the latest CAINE distro on a MacBook Air and will test it on that disk format.

[David (PassMark)]

I meant, are they in raw format, or E01 format, or somehting else?

You've got a Macbook Air that has a disk formatted with NTFS?

[DaleJack]

E01 format.
LOL, no on the MacBook Air - that's HFS+ and the image created was mountable with OSFMount from Windows. Just created and tested it.

[David (PassMark)]

OK, as soon as anyone can make a image available that doesn't work, we'll have a look into it.
(if need be you can ship us a external USB drive and we can return the drive after testing).

[DaleJack]

Ugh, broken in Windows 10 too. All our disks contain forensics data so I'll have to create something non-descript and of various sizes. The small ones work, the large ones do not.

[David (PassMark)]

As mentioned 8 months ago, if someone can supply an image that doesn't work, we'll have a look into it. I am assuming it must be a pretty specific case, as we haven't had any other similar complaints during this period.