Using CAINE and MMLS to mount an image of an NTFS drive

[joetekno]

At some point you my want to view an operating system image file as it was as a file system. This enables quick restoration of files, string searches, e-discovery, etc. The following directions will walk you through mounting an image of an operating system so that you can quickly view it as a file system.

1. Select "Start"... Caine... Caine Interface
2. Click the "Create Report" button
3. Select the "Grissom Analyzer" tab
4. Type the location of your image file (example: /evidence/sda-img.dd)
5. Click the “mmls” button
6. Document the UNITS (example: Units are in 512-byte sectors)
7. Document the start of the partition you wish to mount (example: 0000000063)
8. Multiply the start of the partition with the Units (example 63 X 512 = 32256)
9. Make a directory in /media to mount the image to. The offset below comes from the number you came up with in step 8.
a. Open an Command Line Window
b. Type: sudo su
c. And then enter your password
d. Type: mkdir /media/evidence
e. Type: mount -t ntfs -o loop,ro,offset=32256 /evidence/sda-img.dd /media/evidence
10. Now you can us the “cd” command to view the image file’s directory structure
a. Type: cd /media/evidence
b. Type: ls

[nannib]

Thank you so much!
These various methods for reaching the wished target are very useful
Thank you again for your efforts...

Nanni Bassetti
Caine Team