I assume that the beginning of the section is misinterpreted as MBR or GPT causing the mistake. If it was properly mounted as partition (not disk) this should not happen.
OSFMount: 09:10:27 24-Jan-2023 - ParseCommandLine[3853]: "DEBUGMODE" is a command line argument
OSFMount: 09:10:29 24-Jan-2023 - OSFMount V3.1 Build: 1001 (64-bit)
OSFMount: 09:10:34 24-Jan-2023 - AnalyzeImageFile: attempting to open image file %PATH_redacted%\image.e01
OSFMount: 09:10:37 24-Jan-2023 - AnalyzeImageFile: attempting to open image file %PATH_redacted%\image.e01
OSFMount: 09:10:37 24-Jan-2023 - AnalyzeImageFile: Detecting partition information...
OSFMount: 09:10:38 24-Jan-2023 - GetPartitionInfo: MBR signature check failed (sig=0000, chBootInd=00)
OSFMount: 09:10:38 24-Jan-2023 - Get Boot Sector: Reading boot sector at offset 0
OSFMount: 09:10:38 24-Jan-2023 - GetPartitionInfo: Found ext2 boot sector
OSFMount: 09:10:43 24-Jan-2023 -
Mount new disk: Attempting to mount %PATH_redacted%\image.e01 to drive letter
OSFMount: 09:10:43 24-Jan-2023 - Create Device: Checking if driver is installed
OSFMount: 09:10:48 24-Jan-2023 - GetPartitionInfo: MBR signature check failed (sig=0000, chBootInd=00)
OSFMount: 09:10:48 24-Jan-2023 - Get Boot Sector: Reading boot sector at offset 0
OSFMount: 09:10:48 24-Jan-2023 - GetPartitionInfo: Found ext2 boot sector
OSFMount: 09:10:48 24-Jan-2023 - Refresh device: Detecting file system on device 0/0/0
OSFMount: 09:10:50 24-Jan-2023 - GetPartitionInfo: MBR signature check failed (sig=0000, chBootInd=00)
OSFMount: 09:10:50 24-Jan-2023 - Get Boot Sector: Reading boot sector at offset 0
OSFMount: 09:10:50 24-Jan-2023 - GetPartitionInfo: Found ext2 boot sector
OSFMount: 09:10:50 24-Jan-2023 - Refresh device: Detecting file system on device 0/0/0
Announcement
Collapse
No announcement yet.
How to mount partition/volume images properly in OSFmount?
Collapse
X
-
Could you please launch OSFMount in debug mode, by using the command line parameter DEBUGMODE, and send us a copy of the OSFMount.log that is created after mounting the image (located in the same directory as the OSFmount executable).
Leave a comment:
-
How to mount partition/volume images properly in OSFmount?
Hey there,
according to https://www.osforensics.com/tools/mo...sk-images.html partition/volume-images are supported. There is no option to tell OSFmount whether it is a disk or partition, so I assume it does auto-detection?
anyways, If I mount a ~4 TB image of an EXT Partition, the virtual physical disk generated by OSFmount is only 404GB according to several tools. How can I make OSFmount to create a virtual physical drive in the correct size?
ThanksTags: None
Leave a comment: