Many Windows®-based disk image mounting solutions mount the contents of disk images as shares or partitions, rather than complete (aka "physical or "real") disks, which limits their usefulness to digital forensics practitioners and others. Arsenal Image Mounter mounts the contents of disk images as complete disks in Windows, allowing users to benefit from disk-specific features like integration with Disk Manager, launching virtual machines (and then bypassing Windows authentication and DPAPI), managing BitLocker-protected volumes, mounting Volume Shadow Copies, and more.



Many Windows®-based disk image mounting solutions mount the contents of disk images as shares or partitions, rather than complete (aka "physical or "real") disks, which limits their usefulness to digital forensics practitioners and others. Arsenal Image Mounter mounts the contents of disk images as complete disks in Windows, allowing users to benefit from disk-specific features like integration with Disk Manager, launching virtual machines (and then bypassing Windows authentication and DPAPI), managing BitLocker-protected volumes, mounting Volume Shadow Copies, and more.

Features Available in Professional Mode
- Effortlessly launch virtual machines from disk images
- Extremely powerful Windows authentication and DPAPI bypasses within virtual machines
- Volume Shadow Copy mounting (standard, with Windows NTFS driver bypass, or as complete disks)
- Launch virtual machines directly from Volume Shadow Copies
- Windows file system driver bypass (FAT, NTFS, ExFAT, HFS+, Ext2/3/4, etc.)
- Exposure of NTFS metadata, slack, and unallocated in Windows file system driver bypass mode
- Virtually mount archives and directories
- Save disk images with fully-decrypted BitLocker volumes
- Attach to actual physical disks (fixed and removable) to leverage virtual machine launching, VSC mounting, etc.

"Release Notes"

Launch VM
- Improved DPAPI bypass (details available to customers)
- New advanced option for EFI boot cleanup which removes possibly incompatible EFI boot files
- Automatic repair is now disabled after a failed boot to make serious troubleshooting more efficient
- Fixed issue related to replay of very large Registry transaction logs

Recon Report
- Improved detection of driver/service files, vendor information, and validation
- Additional driver/service information exposed
- Simplified display of Volume Shadow Copy timestamps
- Fixed issue related to Authentication Vaults on very old Windows versions
- Fixed issue related to Windows Dynamic Disks

System Requirements
Windows 10 (version 1703 or later), 11, or Server 2016/2019 x64 with the latest .NET 6 so that all functionality (e.g. launching virtual machines and BitLocker-related functionality) works as intended.

Homepage

https://arsenalrecon.com