OSFMount

OSFMount allows you to mount local disk image files (bit-for-bit copies of a disk partition) in Windows with a drive letter. You can then analyze the disk image file with PassMark OSForensics by using the mounted volume's drive letter. By default, the image files are mounted as read only so that the original image files are not altered.

OSFMount also supports the creation of RAM disks, basically a disk mounted into RAM. This generally has a large speed benefit over using a hard disk. As such this is useful with applications requiring high speed disk access, such a database applications, games (such as game cache files) and browsers (cache files). A second benefit is security, as the disk contents are not stored on a physical hard disk (but rather in RAM) and on system shutdown the disk contents are not persistent.

OSFMount supports mounting images of CDs, which can be useful when a particular CD is used often and the speed of access is important.

Formats supported: Raw Image (.IMG, .DD), Raw CD Image (.ISO, .BIN), Split Raw Image (.00n), Nero Burning ROM Image (.NRG), System Deployment Image (.SDI), Advanced Forensics Format Images (AFF), Advanced Forensics Format Images w/ meta data (AFM), Advanced Forensics Format Directories (AFD) e VMWare Image (.VMDK).