SmartMount
SmartMount is a utility that allows you to mount filesystems contained in logical and physical disk image files. It automatically detects the partitions and filesystems in your images. Simply point and click the volume(s) you wish to mount. It’s that easy!
Filesystems mounted in SmartMount behave just like regular volumes. They are assigned a drive letter in Windows and a filesystem mountpoint in Linux. You can browse these volumes in your favorite GUI environment using any tools you like. Tools that index, search, recover, carve, repair or examine images and filesystems work as you would expect.
Multiple layers of write-protection ensure that the data in your image files will not be modified. SmartMount provides a protected read/write mount mode, writes are redirected to a separate overlay file. Changes made in past SmartMount sessions can be included by reusing an overlay file. Overlay files can also help you detect and isolate changes made while the image is booted in a virtual machine. Overlay files also allow you to repair corrupted file systems within images, remove and reset passwords within images, boot images in a virtual environment and much more.
SmartMount automatically recognizes and supports many common disk image formats. Even if you have an EnCase/Expert Witness image made up of 300 segment files, SmartMount makes it easy. What’s more, SmartMount allows other applications to access the image data even if those applications don’t support split images or special formats. There is no need to waste time and storage space re-imaging your data! Just fire up SmartMount and within seconds your image data is unlocked and ready to use with any application that supports dd-style images (in Linux) or can operate on a drive letter (in Windows).
When used in conjunction with the “Study” feature, SmartMount in linux mounts a “forensic” read-only filesystem that contains active files, deleted files, orphaned filesystem objects and unallocated space. This mountpoint can be shared / exported to the entire network and even re-imaged. This means that studied filesystems no longer require a forensic tool, dongle or specialized (expensive) tools or training for anyone to review.
Studied filesystems may also be mounted without the underlying image data. This is huge in matters involving title 18 materials, redactions and intellectual property concerns. This approach is extremely efficient for performing numerous types of investigations and analyses on large servers, cloud based filesystems, multi-terabyte SANs and many other systems that have been challenging or unavailable using traditional approaches.
Some other image-mounting utilities require you to specify partition offsets manually. Put away that calculator and start using Smart Mount!
Almost any filesystem supported by the underlying OS can be mounted using Smart Mount.
Smart Mount provides automatic detection of the following filesystem types, which helps automate the mounting process.
