Advanced Mounting of dd & EWF images using xmount and kpartx – Linux Command Line tutorial – 33

Linux Command Line tutorial for forensics – 33 – Advanced Mounting of dd & EWF images using xmount and kpartx

♥️ SUBSCRIBE for more videos: https://www.youtube.com/bluemonkey4n6?sub_confirmation=1

Difficulty Level: Intermediate
Prerequisites:
basic understanding of linux command line
basic understanding of the mounting command

In this video we will look at mounting drive images in the raw format or EWF format. We will also look at how to convert a E01/EWF formatted file to a dd/raw format.

Video timeline
00:00 intro
00:38 xmount – converts between various input and output image formats
06:21 disktype to see the partitioning table of the image file
07:07 mount -o loop,offset=$((sector_offset*sector _size)) – mounting a loop device
09:03 kpartx – create device maps from partition tables
12:18 clean up – reverse the process of kpartx/xmount
13:41 recap

⭕️ For other videos about the Linux command line, see other videos in this series: https://www.youtube.com/playlist?list=PLSbhiuoC0XgX70ZtgJ7d-1rLui0jZRabg

Linux distro:
CAINE linux (http://www.caine-live.net)

Virtualization software:
Virtual Box (http://virtualbox.org)

Images used for examination:
Computer Forensic Reference Data Sets (CFReDS) from NIST (https://www.cfreds.nist.gov/data_leakage_case/data-leakage-case.html)

Icons made by freepik from @flaticon http://www.flaticon.com/authors/freepik

Icons made by Smashicons from http://www.flaticon.com/authors/smashicons

This course was designed to provide information on how to use the command line environment in a Unix/Linux system to accomplish tasks such as imaging, data acquisition, and archiving. This course covers the basics of Unix/Linux commands that allow users to view and edit text files, obtain hardware and system information, partitioning and formatting, process related commands, manipulating disks and partitions, imaging, archiving, logical acquisition, live system response, and basic networking.

This would be beneficial for folks who are interested in digital forensics, incidence response, system administration, ethical hacking, or just plain linux. This course covers material for beginners as well as for advanced users. This course would also be helpful if you are considering taking the CompTIA Linux+ certification test.

#DFIR #linux #mounting