Mounting images in a Linux distribution as part of a forensic investigation is very common. Sometimes we don’t have access to expensive license-based software such as Encase or X-Ways and our alternative is to leverage SANS SIFT Workstation or REMnux.
For this post, we are going to be using Ubuntu (the basis for SIFT) to demonstrate how to mount disk and memory images in E01, VMDK, RAW, dd and IMG formats.