CAINE 1.5 Installed and MMLS to mount NTFS image file

[joetekno]

At some point you my want to view an operating system image file as it was as a file system. This enables quick restoration of files, string searches, e-discovery, etc. The following directions will walk you through mounting an image of an operating system so that you can quickly view it as a file system.

NOTE: If you have imaged a partition (sda1 instead of sda) you DO NOT need to find the offset and you can mount the partition to your directory structure using the following command:

[root@forensics1-desktop]# mount -t ntfs -o loop,ro /evidence/sda-img.dd /media/evidence

1. Select "Menu"... Forensic Tools... Caine Interface
2. Type your password if prompted (132456)
3. Click the "Create Report" button
4. Type your casename and Click OK
5. Type your investigator and Click OK
6. Select the "Grissom Analyzer" tab
7. Type the location of your image file (example: /evidence/sda-img.dd)
8. Click the “mmls” button
9. Document the UNITS (example: Units are in 512-byte sectors)
10. Document the start of the partition you wish to mount (example: 0000000063)
11. Multiply the start of the partition with the Units (example 63 X 512 = 32256)

12. Make a directory in /media to mount the image to. (example: /media/evidence) The offset below comes from the number you came up with in step 11.
a. Open an Command Line Window
b. Type: sudo su
c. Enter your password
d. Type: mkdir /media/evidence
e. Type: mount -t ntfs -o loop,ro,offset=32256 /evidence/sda-img.dd /media/evidence

13. Now you can us the “cd” command to view the image file’s directory structure
a. Type: cd /media/evidence
b. Type: ls