OFMount command line -v all option is not working properly.

[haider86]

I have an E01 which has two Mac partition and two Window partition. When I mount it using OFS exe it mount window partition correctly and Mac Partition also shows without any data which is correct, but when i mount I using command line it shows all partition without any data. Attachments shows the issue with the command line.

Command Use:
OSFMount.com -a -t file -f "Computer.E01" -v all -o ro

OFS showing Drive info.
https://www.dropbox.com/s/4xx0z9zs3ctp8br/1.PNG?dl=0

OFS Showing Drive mounted
https://www.dropbox.com/s/cuxg2na7zcgih7t/2.PNG?dl=0

Command Line Drive mounted
https://www.dropbox.com/s/7a7fzmfv3hyzm8j/3.PNG?dl=0

Thank you.

[David (PassMark)]

Did you try mounting them as not read only drives from the command line?

[haider86]

Yes i have tried out the -o ro same result.

[haider86]

I mean without the -o ro option, same results.

[David (PassMark)]

Can we get access to the E01 image file?

[haider86]

Yes https://www.dropbox.com/s/ajgpzfhfr0...tions.E01?dl=0

[Simon (PassMark)]

We were able to reproduce the issue, current workaround we found was by not using the '-v all' arguement - can you try this and let us know if it works for you?

[haider86]

Thank you it work for this E01, Look like it mount only the window partitions, If the E01 has some other partitions, e.g. System Reserved or some Recovery Partition, it doesn't mount them. Only mount the Windows one.

I have another E01 it has a System Reserve partition.
https://www.dropbox.com/s/4xx0z9zs3ctp8br/1.PNG?dl=0

When i mount it without specifying -v all option. It mount only windows partition.
https://www.dropbox.com/s/zm2a9twi8eu926f/4.PNG?dl=0

I was thinking -v all will mount all of them.

Also is there way we can get drive information from E01 before mounting it? like the OFSmount.com exe is doing?

[keith]

We've made the fix to the "-v all" option.

You can download the new build here:
https://www.osforensics.com/tools/mo...sk-images.html

[haider86]

Thank you so much to resolve so quickly, will test and give you my feedback.

[haider86]

Hi we have test the new version but the -v all option is not working with the test e01 file i have send you. below is the screenshot it simply close straight away.

[Simon (PassMark)]

Your screenshot shows that you are using 'WinXP2.E01' which is different from the E01 that you linked to in a earlier post on this thread, which was named 'E01-4_partitions.E01'.
We tested with 'E01-4_partitions.E01' using the -v all command and was able to mount all the partitions.

Can send us this 'WinXP2.E01' file in your screenshot? And also double check that the file is actually in that folder as OSFMount does not throw any error if the file does not exist.

[haider86]

Sorry didn't realize i didn't send you XP E01. Kindly check the attachment, I have test again and make sure that E01 was on the right place.

https://www.dropbox.com/s/ekyuxuax5i...inXP2.E01?dl=1

[haider86]

Hi any update.

[David (PassMark)]

There doesn't seem to be any partitions in that E01 file?
So mounting all partitions doesn't make sense if there are none.