xmount(1) xmount xmount(1)
NAME
xmount - Tool to crossmount between multiple input and output harddisk image files
SYNOPSIS
xmount [[fopts] [mopts]] <ifile> [<ifile> [...]] <mntp>
DESCRIPTION
xmount allows you to convert on-the-fly between multiple input and output harddisk image types. xmount creates a virtual file system using
FUSE (Filesystem in Userspace) that contains a virtual representation of the input image. The virtual representation can be in raw DD, Vir-
tualBox's virtual disk file format, Microsoft's Virtual Hard Disk Image format or in VmWare's VMDK file format. Input images can be raw DD,
EWF (Expert Witness Compression Format) or AFF (Advanced Forensic Format) files. In addition, xmount also supports virtual write access to
the output files that is redirected to a cache file. This makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox,
VmWare or alike.
OPTIONS
fopts: (Options specific to FUSE)
-d: Enable FUSE's and xmount's debug mode.
-h: Display this help message.
-s: Run single threaded.
-o no_allow_other: Disable automatic addition of FUSE's allow_other option.
-o <fmopts> :
Specify fuse mount options. Will also disable automatic addition of FUSE's
allow_other option!
INFO: For VMDK emulation, you have to uncomment "user_allow_other" in
/etc/fuse.conf or run xmount as root.
mopts: (Options specific to xmount)
--cache <file> :
Enable virtual write support and set cachefile to use.
--in <type> :
Specify input image type. Type can be "dd" or "ewf".
--info :
Print out some infos about used compiler and libraries.
--out <type> :
Specify output image type. Type can be "dd", "vdi", "vhd", "vmdk(s)".
--owcache <file> :
Same as --cache <file> but overwrites existing cache.
--rw <cache_file> :
Same as --cache.
--version :
Same as --info.
INFO: Input and output image type defaults to "dd" if not specified.
ifile:
Input image file. If you use EWF files, you have to specify all image
segments! (If your shell supports it, you can use .E?? as file
extension to specify them files)
mntp:
Mount point where virtual files should be located.
BUGS
Hopefully none. If you find any, please e-mail to <bugs@pinguin.lu>.
EXAMPLE
To xmount an EWF image from your acquired disk as a raw DD image under /mnt, use the following command:
xmount --in ewf ./acquired_disk.E?? /mnt
To xmount the same ewf image as vdi file, you would use a command like this:
xmount --in ewf --out vdi ./acquired_disk.E?? /mnt
And to enable virtual write support on a raw DD input image xmounted as VDI file:
xmount --out vdi --cache ./acquired_disk.cache ./acquired_disk.dd /mnt
Gillen Daniel May 9, 2012 xmount(1)