Announcement

Collapse
No announcement yet.

How to mount partition/volume images properly in OSFmount?

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • User376372
    replied
    I assume that the beginning of the section is misinterpreted as MBR or GPT causing the mistake. If it was properly mounted as partition (not disk) this should not happen.

    OSFMount: 09:10:27 24-Jan-2023 - ParseCommandLine[3853]: "DEBUGMODE" is a command line argument
    OSFMount: 09:10:29 24-Jan-2023 - OSFMount V3.1 Build: 1001 (64-bit)
    OSFMount: 09:10:34 24-Jan-2023 - AnalyzeImageFile: attempting to open image file %PATH_redacted%\image.e01
    OSFMount: 09:10:37 24-Jan-2023 - AnalyzeImageFile: attempting to open image file %PATH_redacted%\image.e01
    OSFMount: 09:10:37 24-Jan-2023 - AnalyzeImageFile: Detecting partition information...
    OSFMount: 09:10:38 24-Jan-2023 - GetPartitionInfo: MBR signature check failed (sig=0000, chBootInd=00)
    OSFMount: 09:10:38 24-Jan-2023 - Get Boot Sector: Reading boot sector at offset 0
    OSFMount: 09:10:38 24-Jan-2023 - GetPartitionInfo: Found ext2 boot sector
    OSFMount: 09:10:43 24-Jan-2023 -
    Mount new disk: Attempting to mount %PATH_redacted%\image.e01 to drive letter
    OSFMount: 09:10:43 24-Jan-2023 - Create Device: Checking if driver is installed
    OSFMount: 09:10:48 24-Jan-2023 - GetPartitionInfo: MBR signature check failed (sig=0000, chBootInd=00)
    OSFMount: 09:10:48 24-Jan-2023 - Get Boot Sector: Reading boot sector at offset 0
    OSFMount: 09:10:48 24-Jan-2023 - GetPartitionInfo: Found ext2 boot sector
    OSFMount: 09:10:48 24-Jan-2023 - Refresh device: Detecting file system on device 0/0/0
    OSFMount: 09:10:50 24-Jan-2023 - GetPartitionInfo: MBR signature check failed (sig=0000, chBootInd=00)
    OSFMount: 09:10:50 24-Jan-2023 - Get Boot Sector: Reading boot sector at offset 0
    OSFMount: 09:10:50 24-Jan-2023 - GetPartitionInfo: Found ext2 boot sector
    OSFMount: 09:10:50 24-Jan-2023 - Refresh device: Detecting file system on device 0/0/0​

    Leave a comment:


  • Tim (PassMark)
    replied
    Could you please launch OSFMount in debug mode, by using the command line parameter DEBUGMODE, and send us a copy of the OSFMount.log that is created after mounting the image (located in the same directory as the OSFmount executable).

    Leave a comment:


  • How to mount partition/volume images properly in OSFmount?

    Hey there,

    according to https://www.osforensics.com/tools/mo...sk-images.html partition/volume-images are supported. There is no option to tell OSFmount whether it is a disk or partition, so I assume it does auto-detection?
    anyways, If I mount a ~4 TB image of an EXT Partition, the virtual physical disk generated by OSFmount is only 404GB according to several tools. How can I make OSFmount to create a virtual physical drive in the correct size?

    Thanks
Working...
X