Overview

OSFMount allows you to mount local disk image files (bit-for-bit copies of an entire disk or disk partition) in Windows as a physical disk or a logical drive letter. You can then analyze the disk image file with PassMark OSForensics™ by using the physical disk name (eg. \\.\PhysicalDrive1) or logical drive letter (eg. Z:).

By default, the image files are mounted as read only so that the original image files are not altered.

OSFMount supports mounting disk image files as read/write in "write cache" mode. This stores all writes to a "write cache" (or "delta") file which preserves the integriy of the original disk image file.

OSFMount also supports the creation of RAM disks, basically a disk mounted into RAM. This generally has a large speed benefit over using a hard disk. As such this is useful with applications requiring high speed disk access, such a database applications, games (such as game cache files) and browsers (cache files). A second benefit is security, as the disk contents are not stored on a physical hard disk (but rather in RAM) and on system shutdown the disk contents are not persistent. At the time of writing, we believe this is the fastest RAM drive software available.

OSFMount supports mounting images of CDs in .ISO format , which can be useful when a particular CD is used often and the speed of access is important.

Download

Please click below to download the OSFMount V3.1.1003 installation package

Download the 64-bit OSFMount software for free!

Known issues

#1: On certain Windows systems (mostly Windows server 2016), when using OSFMount, Windows will prevent the OSFMount driver from loading. See the following page for more details, "Why do I get the error, Error loading OSFMount Driver?"

#2: If you get an Access Denied message during install for the osfmount.sys file, or OSFmount driver is disabled error. Reboot the machine and reinstall. A previous version of the driver was likely still loaded in memory, preventing an update.

Supported File Extensions

OSFMount supports the mounting of the following Windows image file formats:

Image Format Read Write Mount as RAM drive Convert to Image file Extend Format
Raw Image (.IMG, .DD)
Raw CD Image (.ISO, .BIN)
Split Raw Image (.00n)
Nero Burning ROM Image (.NRG)
System Deployment Image (.SDI)
Advanced Forensics Format Images* (AFF)
Advanced Forensics Format Images w/ meta data* (AFM)
Advanced Forensics Format Directories* (AFD)
VMWare Image (.VMDK)
EnCase EWF (.E01)
SMART EWF (.S01)
VHD Image (.VHD)

* The supported version of Advanced Forensics Format is AFFv3 with zlib compression support. Encryption and signatures are not supported.

RAM Drive Benchmarks


These RAM drive benchmarks were taken on a Intel i7-12700K CPU with 64GB DDR5 RAM @ 4800MHz in dual channel mode. RAM disk size was 8GB, formatted with FAT32. Typical speeds with large linear blocks are around 10,000 MiB/sec reads and 20,000 MiB/sec writes. With smaller 4K blocks and random access plus queue depth of 1, speed is still a very respectable 1,900 MiB/sec read and 1,000 MiB/sec write. Benchmarks were taken with PerformanceTest V11.

System requirements

Win 10 and Win 11
Win 7 SP1, Win 8, Windows Server 2008, 2012 (Windows Server 2016 has issues) are supported but have not been validated
64bit support (For 32-bit support, please use OSFMount v2)
CPU with SSE4.2 instruction set (i.e. CPUs released after 2010)
Users must have administrator privileges.
RAM: 1GB (When mounting large disk images, the more RAM the better)
Disk space: 15 MB of free hard disk space for the installation files.

What's new

Expand all Collapse all

v3.1.1003, 5 Mar 2024

  • Fixed issue with OSFMount not mounting with physical emulation and causing machine to not boot after restarting on Win10 V1809

v3.1.1002, 15 Sep 2023

  • Fixed mounting of image files located on a network share using physical emulation

v3.1.1001, 6 Jun 2022

  • Added more verbose progress text when mounting image in CLI
  • Fixed bug in mounting all partitions using the "-v all" option in CLI
  • Display error when mounting physical disk with invalid MBR disk signature

v3.1.1000, 5 Mar 2021

  • Updated drivers built with latest WDK and disk image libraries
  • Fixed OSFMount CLI usage text
  • Updated Command Line Interface section in help file with new examples

v3.0.1006, 7 May 2020

  • Added support for specifying 'all' to '-v' option in CLI to mount all detected partitions in image file
  • Fixed error when saving a mounted logical drive greater than 4GB to an image file due to 32-bit truncation errors
  • Fixed logical drives not being recognized by Windows Explorer for older O/S (eg. Win 7) when mounting via CLI

v3.0.1005, 29 Jul 2019

  • Added 'physical' and 'logical' command line option to force physical or logical emulation respectively
  • Fixed image files being opened without share permissions

v3.0.1004, 24 May 2019

  • Fixed driver not being properly uninstalled when an older version is detected
  • Error message now displayed when system reboot is required after driver installation

v3.0.1003, 10 May 2019

  • Fixed extremely slow disk performance of single part EnCase disk images inadvertently introduced by the previous fix

v3.0.1002, 8 May 2019

  • Fixed extremely slow disk performance of split EnCase disk images
  • Fixed unable to query or dismount drive via CLI when disk is in use
  • Fixed UI draw issues on Win7 Basic Theme

v3.0.1001, 17 Apr 2019

  • Fixed bug with error message displayed when mounting an image in read/write mode using logical emulation
  • Fixed bug with ImageUSB images being mounted as CD

v3.0.1000, 5 Apr 2019

  • Mount a virtual disk using Physical Disk emulation, allowing the disk to be recognized by Windows Disk Management
  • Added Write Cache mode to allow mounting a virtual disk as read-write while preserving the data of the original image file
  • New step-by-step wizard for mounting virtual disks with simplicity
  • NTFS, exFAT and FAT32 now supported when formatting a drive
  • Revised columns in main window with support for physical disk emulation
  • Added support in the OSFMount CLI for mounting using Physical Disk emulation

v2.0.1001, 21 Mar 2018

  • Updated/added warning and error messages when using format option on command line when specifying a ram drive that is smaller than 260MB.
  • Fixed issue with detecting partitions for ImageUSB images.
  • Microsoft signed OSFMount.sys device driver for Windows 10.

v2.0.1000, 08 Mar 2018

    Download:

    64-bit Windows 7 SP1, 8, 10, 11, Server 2008 & 2012 are supported. For 32-bit Windows, please download OSFMount v2 below.

  • Compiled with Visual Studio 2017 and Driver Built using WinDDK 10. Consequence of this is that the minimum OS required is now Windows 7 SP1 and we are longer supporting older operating systems XP & Vista.
  • Dramatic speed improvements for blank RAM disks. Speed improvements are a result of,
    • New compiler with better code optimization
    • Forcing the RAM drive to be held in physical RAM (if free space is available on initial mounting). So no swapping to disk. Making it more important than ever to make sure you have sufficient free RAM available.
    • Rewrite of the device driver code to remove overheads in the handling of I/O request packets (IRPs), which read and write data from the RAM drive.
  • At the time of this release, we believe this is the fastest RAM drive software available. Some examples of the speed increases compared to the previous release are 290% faster for 4K IOPS reads and 57% faster linear reads.
  • Updated EWF library to libewf-20160424

v1.5.1018, 18 Jan 2018

  • Fixed issue with not recognizing partitions from large E01 images after mounting.
  • Warning shown when formatting small drives. OSFMount cannot format empty ram drives that are smaller than 260 MB. They may be possible to be formatted using Windows.

v1.5.1017, 12 Dec 2017

  • AAdded option to specify Volume Label when formatting. For Command Line, specify format:"Vol Label" under the options (-o). Example Syntax:
    osfmount -a -t vm -m "F:" -o format:"RamDisk" -s 1G
  • OSFMount GUI will new auto refresh drive list when images are mounted/unmounted using Command Line Interface.
  • When mounting a new image using the command line and the mount point specified already exists, OSFMount will fail.

v1.5.1016, 27 Nov 2017

  • Added "Format as FAT32" as a mount option to newly created Empty RAM drives. For Command Line, specify "format" under the options (-o). Example Syntax:
    osfmount -a -t vm -m "F:" -o format -s 1G

v1.5.1015, 7 Feb 2014

  • Added VHD image file support. VHD is the Virtual Hard Disk file format for disk images, as used by Micrsoft's Virtual PC. This includes support for Dynamic-size (or sparse) hard disk images. Differential images are not supported. Support was added via libvhdi.
  • Updated EWF library to libewf-20131230
  • Confirmed Win8.1 support

v1.5.1014, 22 Oct 2013

  • Fixed issue with detecting partitions for ImageUSB images
  • Windows dynamic disks are now supported
  • Fixed issue with mounting via OSFMount command line with "-o rw" option
  • Fixed issue with mounting multiple partitions in an image file as writable due to file sharing permissions
  • Fixed issue with mounting multiple partitions in an image file from command line
  • Drive letters 'A' and 'B' can now be used
  • Propagated changes from Imdisk v1.7.5 including some key fixes:
    • Disks with "lost" drive letters can now be removed
    • Notifications hanging on drive creation and removal

v1.5.1013, 7 Mar 2013

  • Columns and main window are now resizable
  • Added "DEBUGMODE" command line parameter to OSFMount (GUI) for debug logging
  • Added "File system (detected)" column in the mounted drive list (for file systems unsupported by OS)
  • APM partition scheme is now supported, along with more robust partition detection

v1.5.1012, 27 Dec 2012

  • Fixed an issue with logical (extended) partitions not being displayed in the list when selecting a partition

v1.5.1011, 09 May 2012

  • Fixed OSFMount driver load error in Win2k3 64-bit
  • OSFMount command line now supports setting drive type (eg. CD, HD, FD) via the -o option

v1.5.1010, 03 Apr 2012

  • Fixed error when mounting multiple drives backed by the same image file. This includes attempting to mount all partitions from an image file as individual drives.

v1.5.1009, 13 Mar 2012

  • Browsing for an image file automatically prompts the user to select a partition
  • Changed 'Select Partition' button to a hyperlink

v1.5.1008, 22 Nov 2011

  • Added option to mount all partitions in an image to separate drive letters with a single click

v1.5.1007, 27 Jun 2011

  • Added option to dismount all drives upon exit of the application
  • Fixed OSFMount logo containing incorrect version number

v1.5.1006, 16 Jun 2011

  • Added command line support via OSFMount.com console application
  • Fixed 'Browse' file dialog to show all file extensions

v1.5.1005, 01 Jun 2011

  • Fixed crash when mounting incomplete split files

v1.5.1004, 25 Apr 2011

  • Added support for mounting EnCase/SMART images as read/write
  • Added support for saving disks as EnCase/SMART images ( .E01 format )
  • Fixed issue with mounting larger VMWare images
  • Fixed crash when mounting a large image into RAM

v1.5.1003, 21 Apr 2011

  • Fixed issue with mounting images split into a large number of files (eg. AFD, E01)

v1.5.1002, 20 Apr 2011

  • Added read support for EnCase / SMART EWF format images, typically these have the .E01 file name extension

v1.5.1001, 14 Apr 2011

  • Fixed offset/size calculation for images with one partition, which was preventing the mounting of some image files.

v1.5.1000, 16 Mar 2011

  • Fixed issue with virtual disks > 4GB. It is now possible to create RAM drives greater than 4GB and not have them corrupt themselves in 64bit
  • Fixed issue with memory not deallocating properly when dismounted
  • Added support for mounting GUID partition table (GPT) based disks
  • Fixed issue with extended partitions
  • Improved the add drive window to simplify the options.

v1.4.1005, 27 Jan 2011

  • Bug corrected from 1.4.1004 where the mounted drive letter may not appear in Windows Explorer

v1.4.1004, 21 Jan 2011

  • Minor corrections

v1.4.1003, 17 Dec 2010

  • Added support for ImageUSB image files. So images of USB drives from ImageUSB can now be mounted.
  • Fixed issue with mounting on a drive letter that is already being used as a network drive
  • Fixed issue with improperly loading/unloading OSFMount driver
  • Fixed issue with drive icon remaining in Windows Explorer even after dismounting

v1.4.1002, 15 Dec 2010

  • Fixed issue with large physical memory usage for non-raw images
  • Fixed issue with incorrectly detecting MBR
  • Added status window for analyzing images before mounting
  • Optimized loading of AFF images
  • Synced with afflib-3.6.4

v1.4.1001, 8 Dec 2010

  • Error checking for NTFS partition size / image size mismatch and code to try and deal with it
  • Error checking for encrypted AFF images
  • Support for AFF directories (AFD)
  • Updated OSFMount logo

v1.4.1000, 6 Dec 2010

  • Support for split raw, AFF, VMWare images .VMDK, CD ISO images
  • Various minor bug fixes

v1.3.1000, 25 Oct 2010

  • First version based on ImDisk V1.3 by Olof Lagerkvist. Branched to support forensic file formats.