1xmount(1) xmount xmount(1)
2
6 xmount - Tool to crossmount between multiple input and output harddisk
7 image files
8
11 xmount [fopts] <xopts> <mntp>
12
15 xmount allows you to convert on-the-fly between multiple input and out‐
16 put harddisk image formats. xmount creates a virtual file system using
17 FUSE (Filesystem in Userspace) that contains a virtual representation
18 of the input image.
19 The virtual representation can be in raw DD, Apple's Disk Image format
21 (DMG), VirtualBox's virtual disk file format (VDI), Microsoft's Virtual
22 Hard Disk Image format (VHD) or in VmWare's VMDK file format.
23 Input images can be raw DD, EWF (Expert Witness Compression Format) or
25 AFF (Advanced Forensic Format) files.
26 In addition, xmount also supports virtual write access to the output
28 files that is redirected to a cache file. This makes it possible to
29 boot acquired harddisk images using QEMU, KVM, VirtualBox, VmWare or
30 alike.
31
34 fopts: (Options specific to FUSE)
35 -d: Enable FUSE's and xmount's debug mode.
36 -h: Display this help message.
37 -s: Run single threaded.
38 -o no_allow_other: Disable automatic addition of FUSE's allow_other
39 option.
40 -o <fmopts> :
41 Specify fuse mount options. Will also disable automatic addition of
42 FUSE's
43 allow_other option!
44 xopts: (Options specific to xmount)
46 --cache <cfile> : Enable virtual write support.
47 <cfile> specifies the cache file to use.
48 --in <itype> <ifile> : Input image format and source file(s). May be
49 specified multiple times.
50 For a list of supported <itype> types, run xmount --info and look
51 under "loaded input libraries".
52 <ifile> specifies the source file. If your image is split into mul‐
53 tiple files, you have to specify them all!
54 --inopts <iopts> : Specify input library specific options.
55 <iopts> specifies a comma separated list of key=value options.
56 --info : Print out infos about used compiler and loaded libraries.
57 --morph <mtype> : Morphing function to apply to input image(s). If
58 not specified, defaults to "combine".
59 For a list of supported <mtype> types, run xmount --info and look
60 under "loaded morphing libraries".
61 --morphopts <mopts> : Specify morphing library specific options.
62 <mopts> specifies a comma separated list of key=value options.
63 --offset <off> : Move the output image data start <off> bytes into
64 the input image(s).
65 --out <otype> : Output image format. If not specified, defaults to
66 "raw".
67 <otype> can be "raw", "dmg", "vdi", "vhd", "vmdk", "vmdks".
68 --owcache <file> : Same as --cache <file> but overwrites existing
69 cache file.
70 --sizelimit <size> : The data end of input image(s) is set to no more
71 than <size> bytes after the data start.
72 --version : Same as --info.
73 mntp:
75 Mount point where virtual files should be located.
76
79 Hopefully none. If you find any, please e-mail to <bugs@pinguin.lu>.
80
83 To xmount an EWF image from your acquired disk as a raw DD image under
84 /mnt, use the following command:
85 xmount --in ewf ./acquired_disk.E?? /mnt
87 To xmount the same ewf image as vdi file, you would use a command like
89 this:
90 xmount --in ewf ./acquired_disk.E?? --out vdi /mnt
92 And to enable virtual write support on a raw DD input image xmounted as
94 VDI file:
95 xmount --in raw ./acquired_disk.dd --out vdi --cache ./disk.cache
97 /mnt
98Daniel Gillen Nov 05, 2016 xmount(1)