Mounting Images on Linux Forensic Stations

Linux Drives/Images

Cannot verify E01 hashes by hashing the files directly, need to use the tool ewfverify as the hash of the original image is installed inside the E01 file.

ewfverify -d sha1 ./<E01 FilePath>

This decompresses the image pulls the original data then hashes the image.

Once the hash is verified ewfmount can then be used to mount the E01 image.

most commands will require sudo permissions

ewfmount ./<E01FilePath> ./<mountpoint>

Then use the file command to check the image type. If its a physical disk mmls can be used to view the partition table.

Cool command for calculating offset in bytes this is needed because mmls will give the offset in sectors. Check the sector size reported.

echo <sectorstart> \* <sectorsize> | bc

Using the byte offset can then mount the logical image. mount -o ro,loop,offset=<byteoffset> ./<originalewf1> ./<logicalmountpoint>

Once the logical idsk is mounted to a directory it is best then to operate within it as root

chroot ./<logicalmountpoint> Once executed commands such as journalctl will operate aif run on the users machine

journalctl --list --boots

Use the exit command to return to original system

Windows Drives/Images

When it comes to mounting windows devices the process is very similar however a different command will need to be used to mount the logical image from the ewf1 mount point

mount -t ntfs-3g -o loop,ro,show_sys_files,stream_interface=windows,offset=<byteoffset> /mnt/ewf1/ewf1 /mnt/windows_mount/

umount can be used to remove all mounts