Create an image of a network location

Creating a true drive image of a network location remotely is not possible, it is however possible to create something similar using the Forensic Copy function of OSF. If you are tyring to image a mapped network drives and you cannot see it in OSF please refer to this page.

Firstly you need to create an empty drive image that you will copy the network location to. To do this open OSFMount and (Click "Mount Drive Image" in OSF) and then create a new select 'mount new'. You will then want to select a 'Image File' as the source, set the image filepath to a file that doesn't already exist and set the size of the drive to be big enough to hold all the data you want to copy to it. Also disable "Read-only drive".

OSFMount New Drive Setting

Once the drive is mounted Windows will prompt you to format it, you should do so, default settings are fine unless you have some special requirements.

Next from within OSForensics go the the "Forensic Copy" module, select the network location you want to copy as the source and the newly created blank drive as the destination and click start.

OSFMount New Drive Setting

Once the copy is complete you can then unmount the drive or right click and set read only in OSFMount to prevent any future changes.