Physical Image and Partition Mounting in Tsurugi Linux
Channel: DFIRScience
Date: 2021-10-05

This is a basic DFIR skill, but extremely useful. Demonstrated on Tsurugi Linux.

Sometimes it is helpful to access data inside a forensic disk image without going through carving and processing. For example, when you want to use tools to search for or process data, the tools do not 'understand' forensic disk images. In this video, we use Tsurugi with ewfmount and the built-in 'mount' command to access a file system of a suspect disk image. The same commands will work on other versions of Linux as well.

Tsurugi Linux has pre-configured directories that make mounting disk images very easy. We will use an expert witness file (EWF) (E01) as an example. First, mount the physical disk image with ewfmount. Then use the Sleuth Kit mmls to find the partition table and get the offset to the target partition. Calculate the byte offset. Then use 'mount' to mount the target partition. From there, you should have access to the suspect's data as if their hard drive were directly connected to your system.

00:00 Tsurugi Linux
00:14 Goals of the video
00:26 Selecting tools from the Applications menu
01:04 Open a command prompt (terminal)
01:32 Tsurugi home directory non-standard folders
01:49 Why image mounting?
02:15 Tsurugi Linux mnt directory
03:08 Mount an EWF physical disk image (E01)
04:31 Access the mounted disk image
04:52 tsk mmls for disk partition table
05:28 Calculate byte offset to partition
06:27 Mount a partition inside a physical disk image
07:32 Accessing the mounted partition file system
08:12 Overview
08:44 Thanks for watching

🚀 Full Digital Forensic Courses → https://learn.dfir.science

010001000100011001010011011000110110100101100101011011100110001101100101 
Get more Digital Forensic Science
  👍 Subscribe → https://bit.ly/2Ij9Ojc
  ❤️ YT Member → https://bit.ly/DFIRSciMember
  ❤️ Patreon → https://www.patreon.com/dfirscience

🕸️ Blog → https://DFIR.Science
🤖 Code  → https://github.com/DFIRScience
🐦 Follow → https://www.twitter.com/DFIRScience
📰 DFIR Newsletter → https://bit.ly/DFIRNews
010100110111010101100010011100110110001101110010011010010110001001100101

Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. Please link back to the original video. If you want to use this video for commercial purposes, please contact us first. We would love to see what you are doing.

Experiment 003:
House of the dragon, super smash bros, todo o nada, Facebook, peacemaker, squid game