LinImageMounter

LinImageMounter is a Python tool designed to simplify the process of mounting disk images on Linux systems. It provides a user-friendly command line interface to mount disk images, making it easier for forensic analysts, system administrators, and enthusiasts to access the contents of disk images without the need for complex commands or manual setup.

Features

• Easy to Use: Simple command line interface to mount and unmount disk images.
• Automatic Detection: The partition, LVM, and filesystems in the disk image are automatically detected and mounted accordingly.
• Forensic Mode: For forensics, disk images are mounted in read-only mode by default.
• Unaltered Disk Images: Disk images remain completely unaltered during mounting, even when mounted in read-write mode, ensuring the integrity of the original data.

Requirements

• Python 3.6 or later

Installation

Install LinImageMounter using the following command:

git clone https://github.com/mnrkbys/linimagemounter.git

Usage

To mount a disk image, simply run:

sudo python3 ./linimagemounter.py mount -i /path/to/your/image.E01

Note

By default, /mnt/linimagemounter is used as the base mount point. You can specify another if needed.

Check the current mounting status:

sudo python3 ./linimagemounter.py status

Note

Mount-related information is saved in ~/.linimagemounter/linimagemounter.json. When using sudo, it is often saved under /root/.linimagemounter/.

To unmount the disk image, use:

sudo python3 ./linimagemounter.py unmount

For more detailed usage instructions and options, refer to the help:

python3 ./linimagemounter.py --help

Contributing

Contributions are encouraged! If you wish to contribute, please fork the repository and create a feature branch. Pull requests are greatly appreciated.

Limitations

• Currently, LinImageMounter does not support LUKS, eCryptfs, software RAID (mdadm), or similar technologies.
• LinImageMounter is based on xmount, and thus only raw DD and EWF (E01) disk images are supported.
• Since LinImageMounter is designed to only mount Linux disk images, errors may occur when mounting disk images from other operating systems.
• LinImageMounter depends on some Linux-specific commands and external tools for mounting disk images. Ensure that all necessary dependencies are installed on your system.
• If the LVM volume group names in a disk image conflict with already mounted ones, they cannot be mounted. The --change-vgname option solves this by renaming them during mounting.

Tested filesystem

• ext4
• ext4 on LVM
• XFS on LVM
• Btrfs (single disk and RAID 1)

Testing Environment

Please note that testing has been conducted exclusively on the SANS SIFT Workstation environment. Compatibility with other environments has not been verified.

Author

Minoru Kobayashi

License

LinImageMounter is released under the Apache License, Version 2.0. See the LICENSE file for more details.