Skip to main content

STEP 5: Disk Mounting

First, identify the partition START SECTOR​

note

This step only applies to full disk images, not individual partition images - as partition images can be directly mounted since their offset is always 0.

  1. First identify the specific partition you want to mount
  2. Multiply the previously identified START SECTOR number by 512 to be used as the Byte Offset to provide to other tools when mounting the specific partition from within the image file/disk device: 
    echo $((<START_SECTOR>*512))

Decrypting Domain-Joined BitLocker Disk Images​

note
  • BitLocker encrypted disks must be decrypted prior to being able to mount.
  • BitLocker recovery keys for a machine can be retrieved by a Domain Administrator from within Active Directory.
  1. Login to a machine that is joined to the same domain as the machine that you are decrypting the disk image of, as a Domain Administrator, or user with permissions to view BitLocker recovery keys
  2. Open an administrative PowerShell Console and execute the following commands to retrieve the BitLocker recovery key for the machine: 
    $Computer = Get-ADComputer <HOSTNAME>
    $ADObject = Get-ADObject -Filter 'objectClass -eq "msFVE-RecoveryInformation"' -SearchBase $Computer.DistinguishedName
    $ADObject.'msFVE-RecoveryPassword'
  3. From the SIFT VM, create a folder to expose the decrypted partitions to: 
    sudo mkdir /mnt/decrypt
    note
    • If the image file/block device you are interacting is not that of a single partition (is a full disk with multiple partitions), you will need to specify the offset of the BitLocker encrypted partition within the image by adding -o <OFFSET> to the arguments of the bdemount command.  If there are multiple partitions within the BitLocker encrypted image, they will appear as multiple files in /mnt/decrypt/ with a sequential number appended to the end of the bde filename.
  4. Decrypt the BitLocker image using the SIFT Workstation bdemount tool to expose the contents in the /mnt/decrypt folder 
    sudo bdemount -r <RECOVERY_KEY> <FILE/DISK> /mnt/decrypt
note

The E0# file is and EnCase image file format used by EnCase software. The file is used to store digital evidence including volume images, disk image, memory and logical files. Encase creates multiple E0# files of uniform size 640 MB for storing the acquired digital data. The E01 file will automatically account for split E02, E03, etc. files when mounting.

  1. Mount the E01 file using the SIFT ewfmount tool to expose the contents in the /mnt/ewf folder (which is usually the raw logical image of a disk or partition, which still needs to be mounted - again): 
    sudo ewfmount <FILE>.E01 /mnt/ewf
  2. Continue mounting the /mnt/ewf/* file(s) as a raw image using the other procedures in this SOP

Mounting NTFS Partitions​

note

If the image file/block device you are interacting is not that of a single partition (is a full disk with multiple partitions), you will need to specify the offset of the partition within the image by adding offset=<OFFSET> to the -o arguments of the mount command.

  1. Create a folder to use as a mount point for the partition: 
    sudo mkdir <MOUNT_POINT>
  2. Mount the NTFS partition as read-only while exposing Alternate Data Streams and System files: 
    sudo mount -t ntfs -o loop,ro,noexec,show_sys_files,streams_interface=windows <FILE/DISK> <MOUNT_POINT>

Mounting Most Other Partitions​

note

The mount tool can attempt to identify the filesystem and mount a partition appropriately without the need additional options.

  1. Create a folder to use as a mount point for the partition: 
    sudo mkdir <MOUNT_POINT>
  2. Mount the partition as read-only: 
    sudo mount -o loop,ro,noexec <FILE/DISK> <MOUNT_POINT>

Mounting APFS Partitions​

PREREQUISITE SOFTWARE

This method requires an internet connection to download the required APFS tools since most non-Mac OS’s do not natively recognize APFS file systems. Execute the following commands from an internet-connected SIFT VM to install the software:

sudo apt-get install libfuse-dev libbz2-dev cmake-curses-gui -y
sudo apt-get install hfsprogs libattr1-dev libicu-dev cmake -y
git clone https://github.com/sgan81/apfs-fuse
mkdir ./apfs-fuse/build
cd ./apfs-fuse/3rdparty/
git clone https://github.com/lzfse/lzfse.git
cd ../build
sudo cmake ..
sudo ccmake . # Set USE_FUSE3 to OFF -> enter c -> enter g
sudo make
sudo chown root:root apfs*
sudo cp apfs* /usr/bin/
note

If the image file/block device you are interacting is not that of a single partition (is a full disk with multiple partitions), you will need to specify the offset of the partition within the image by adding -o <OFFSET> to the arguments of the losetup command.

  1. Setup a loop device to be mounted as a block device: 
    sudo losetup -r <FILE/DISK>
  2. Create a folder to use as a mount point for the partition: 
    sudo mkdir <MOUNT_POINT>
  3. Mount the loop device as an APFS filesystem: 
    sudo apfs-fuse /dev/loop# <MOUNT_POINT>