Multipart E01 is not mounting as physical drive

[haideraqeel86]

I'm trying to mount a multi part E01 using CLI command, it didn't mount and give me below error.

"C:\Users\Admin\Desktop\triage-viewer\Application Resources\OSFMount\OSFMount.com" -a -t file -f "C:\Users\Admin\Desktop\Special Tests\E01 Files\EO1 Multi Part\Multi Test E01.E01" -o physical

Creating device...
Done.
Cannot set disk in writable online mode:

The request could not be performed because of an I/O device error.

If I mount it using GUI it mount correctly and show me drive letter.

[keith]

We weren't able to reproduce it with our own multipart E01 image.

What version of Windows are you using?
What version of OSFMount are you using?
Are you running Command Prompt with Admin privileges?
Are you able to successfully mount single part E01 images?

If the issue occurs only for this particular image (and it does not contain sensitive data), would it be possible to upload to Dropbox, OneDrive, etc.?

[haideraqeel86]

What version of Windows are you using?
I'm using Windows 10.

What version of OSFMount are you using?
I'm using OFSMount V3.0 (1006)

Are you running Command Prompt with Admin privileges?
yes

Are you able to successfully mount single part E01 images?
yes

If the issue occurs only for this particular image (and it does not contain sensitive data), would it be possible to upload to Dropbox, OneDrive, etc.?
https://www.dropbox.com/sh/1auskdju0...Va3ryvgoa?dl=1

[David (PassMark)]

We've got the E01 file. Give us a couple of days to have a look at it.

[keith]

We were able to reproduce the error message, though the disk did appear as mounted in Windows Disk Manager (albeit as "Not Initialized").
The reason for the error appears to be because the mounted disk fails to get initialized by Windows Disk Manager.

If the image is mounted as read/write (write cache), however, the disk (and included volume) mounts OK. The command used was as follows:

C:\Program Files\OSFMount>OSFMount.com -a -t file -f "f:\EO1 Multi Part\Multi Test E01.E01" -o wc
Creating device...
Done.

Looking at it further, it seems that in the MBR of the original image, the disk signature has a value of 00000000.
Windows does not like this and therefore does not initialize or mount any volumes on the disk.

When mounting as R/W, however, Disk Manager automatically corrects this issue, generates one for the disk and writes it to the MBR.
After that, the disk can be used normally.

See the following screenshot from OSForensics for the MBR differences.


We will look into improving the error message to include possible solutions/workarounds.

[haideraqeel86]

Thank you for looking into it, and its working now. Just to confirm, the (write cache) will only change the E01 in memory not change the actual E01?

[haideraqeel86]

Just for Note. Using below command the single E01 was not working and was giving error.

Error: A drive letter mount point (-m) must be specified.

C:\Program Files\OSFMount>OSFMount.com -a -t file -f "f:\single.E01" -o wc

I have change it with C:\Program Files\OSFMount>OSFMount.com -a -t file -f "f:\single.E01" -o physical,wc