OSFMount

Use OSFMount to mount dd images! Designed for use with OSForensics.

OSFMount is a free utility designed for use with PassMark OSForensics

Overview

OSFMount allows you to mount local disk image files (bit-for-bit copies of a disk partition) in Windows with a drive letter. You can then analyze the disk image file with PassMark OSForensics™ by using the mounted volume's drive letter. By default, the image files are mounted as read only so that the original image files are not altered.

OSFMount also supports the creation of RAM disks, basically a disk mounted into RAM. This generally has a large speed benefit over using a hard disk. As such this is useful with applications requiring high speed disk access, such a database applications, games (such as game cache files) and browsers (cache files). A second benefit is security, as the disk contents are not stored on a physical hard disk (but rather in RAM) and on system shutdown the disk contents are not persistent. At the time of writing, we believe this is the fastest RAM drive software available.

OSFMount supports mounting images of CDs in .ISO format , which can be useful when a particular CD is used often and the speed of access is important.

Download

Please click below to download the OSFMount V2.0.1001 installation package

Previous Version: OSFMount V1.5.1018 32-bit 64-bit

Known issues

#1: On certain Windows systems (mostly Windows server 2016), when using OSFMount, Windows will prevent the OSFMount driver from loading. See the following page for more details, "Why do I get the error, Error loading OSFMount Driver?"

#2: If you get an Access Denied message during install for the osfmount.sys file, or OSFmount driver is disabled error. Reboot the machine and reinstall. A previous version of the driver was likely still loaded in memory, preventing an update.

Supported File Extensions

OSFMount supports the mounting of the following Windows image file formats:

Image Format Read Write Mount as RAM drive Convert to Image file Extend Format
Raw Image (.IMG, .DD)
Raw CD Image (.ISO, .BIN)
Split Raw Image (.00n)
Nero Burning ROM Image (.NRG)
System Deployment Image (.SDI)
Advanced Forensics Format Images* (AFF)
Advanced Forensics Format Images w/ meta data* (AFM)
Advanced Forensics Format Directories* (AFD)
VMWare Image (.VMDK)
EnCase EWF (.E01)
SMART EWF (.S01)
VHD Image (.VHD)

* The supported version of Advanced Forensics Format is AFFv3 with zlib compression support. Encryption and signatures are not supported.

RAM Drive Benchmarks

These RAM drive benchmarks were taken on a Intel i7-8700K CPU with 32GB RAM DDR4 PC4-19207 in dual channel mode. RAM disk size was 2GB, formatted with FAT32. Typical speeds with large linear blocks are around 10,000 MBytes/sec. With smaller 4K blocks and random access plus queue depth of 1, speed is still a very respectable 1,500 MByte/sec. Benchmarks were taken with PerformanceTest V9.

RAM drive benchmark using OSFMount

 

System requirements

Win 7 SP1, Win 8, and Win 10
Windows Server 2008, 2012
Windows Server 2016 has issues
32bit and 64bit support
It is recommended that 64-bit Windows is used when large disk image files are to be mounted. The 32-bit version can only be used on 32-bit Windows. The 64-bit version can only be used on 64-bit Windows.
Users must have administrator privileges.
RAM: 1GB. When mounting large disk images, the more RAM the better.
Disk space: 10 MB of free hard disk space for the installation files.

Price

OSFMount is a free utility.

What's new

v2.0.1001, 21 Mar 2018

  • Updated/added warning and error messages when using format option on command line when specifying a ram drive that is smaller than 260MB.
  • Fixed issue with detecting partitions for ImageUSB images.
  • Microsoft signed OSFMount.sys device driver for Windows 10. This provides compatibility with more versions of Windows.

v2.0.1000, 08 Mar 2018

  • Compiled with Visual Studio 2017 and Driver Built using WinDDK 10. Consequence of this is that the minimum OS required is now Windows 7 SP1 and we are longer supporting older operating systems XP & Vista.
  • Dramatic speed improvements for blank RAM disks. Speed improvements are a result of,
    • New compiler with better code optimization
    • Forcing the RAM drive to be held in physical RAM (if free space is available on initial mounting). So no swapping to disk. Making it more important than ever to make sure you have sufficient free RAM available.
    • Rewrite of the device driver code to remove overheads in the handling of I/O request packets (IRPs), which read and write data from the RAM drive.
  • At the time of this release, we believe this is the fastest RAM drive software available. Some examples of the speed increases compared to the previous release are 290% faster for 4K IOPS reads and 57% faster linear reads.
  • Updated EWF library to libewf-20160424

v1.5.1018, 18 Jan 2018

  • Fixed issue with not recognizing partitions from large E01 images after mounting.
  • Warning shown when formatting small drives. OSFMount cannot format empty ram drives that are smaller than 260 MB. They may be possible to be formatted using Windows.

v1.5.1017, 12 Dec 2017

  • AAdded option to specify Volume Label when formatting. For Command Line, specify format:"Vol Label" under the options (-o). Example Syntax:
    osfmount -a -t vm -m "F:" -o format:"RamDisk" -s 1G
  • OSFMount GUI will new auto refresh drive list when images are mounted/unmounted using Command Line Interface.
  • When mounting a new image using the command line and the mount point specified already exists, OSFMount will fail.

v1.5.1016, 27 Nov 2017

  • Added "Format as FAT32" as a mount option to newly created Empty RAM drives. For Command Line, specify "format" under the options (-o). Example Syntax:
    osfmount -a -t vm -m "F:" -o format -s 1G

v1.5.1015, 7 Feb 2014

  • Added VHD image file support. VHD is the Virtual Hard Disk file format for disk images, as used by Micrsoft's Virtual PC. This includes support for Dynamic-size (or sparse) hard disk images. Differential images are not supported. Support was added via libvhdi.
  • Updated EWF library to libewf-20131230
  • Confirmed Win8.1 support

v1.5.1014, 22 Oct 2013

  • Fixed issue with detecting partitions for ImageUSB images
  • Windows dynamic disks are now supported
  • Fixed issue with mounting via OSFMount command line with "-o rw" option
  • Fixed issue with mounting multiple partitions in an image file as writable due to file sharing permissions
  • Fixed issue with mounting multiple partitions in an image file from command line
  • Drive letters 'A' and 'B' can now be used
  • Propagated changes from Imdisk v1.7.5 including some key fixes:
    • Disks with "lost" drive letters can now be removed
    • Notifications hanging on drive creation and removal

v1.5.1013, 7 Mar 2013

  • Columns and main window are now resizable
  • Added "DEBUGMODE" command line parameter to OSFMount (GUI) for debug logging
  • Added "File system (detected)" column in the mounted drive list (for file systems unsupported by OS)
  • APM partition scheme is now supported, along with more robust partition detection

v1.5.1012, 27 Dec 2012

  • Fixed an issue with logical (extended) partitions not being displayed in the list when selecting a partition

v1.5.1011, 09 May 2012

  • Fixed OSFMount driver load error in Win2k3 64-bit
  • OSFMount command line now supports setting drive type (eg. CD, HD, FD) via the -o option

v1.5.1010, 03 Apr 2012

  • Fixed error when mounting multiple drives backed by the same image file. This includes attempting to mount all partitions from an image file as individual drives.

v1.5.1009, 13 Mar 2012

  • Browsing for an image file automatically prompts the user to select a partition
  • Changed 'Select Partition' button to a hyperlink

v1.5.1008, 22 Nov 2011

  • Added option to mount all partitions in an image to separate drive letters with a single click

v1.5.1007, 27 Jun 2011

  • Added option to dismount all drives upon exit of the application
  • Fixed OSFMount logo containing incorrect version number

v1.5.1006, 16 Jun 2011

  • Added command line support via OSFMount.com console application
  • Fixed 'Browse' file dialog to show all file extensions

v1.5.1005, 01 Jun 2011

  • Fixed crash when mounting incomplete split files

v1.5.1004, 25 Apr 2011

  • Added support for mounting EnCase/SMART images as read/write
  • Added support for saving disks as EnCase/SMART images ( .E01 format )
  • Fixed issue with mounting larger VMWare images
  • Fixed crash when mounting a large image into RAM

v1.5.1003, 21 Apr 2011

  • Fixed issue with mounting images split into a large number of files (eg. AFD, E01)

v1.5.1002, 20 Apr 2011

  • Added read support for EnCase / SMART EWF format images, typically these have the .E01 file name extension

v1.5.1001, 14 Apr 2011

  • Fixed offset/size calculation for images with one partition, which was preventing the mounting of some image files.

v1.5.1000, 16 Mar 2011

  • Fixed issue with virtual disks > 4GB. It is now possible to create RAM drives greater than 4GB and not have them corrupt themselves in 64bit
  • Fixed issue with memory not deallocating properly when dismounted
  • Added support for mounting GUID partition table (GPT) based disks
  • Fixed issue with extended partitions
  • Improved the add drive window to simplify the options.

v1.4.1005, 27 Jan 2011

  • Bug corrected from 1.4.1004 where the mounted drive letter may not appear in Windows Explorer

v1.4.1004, 21 Jan 2011

  • Minor corrections

v1.4.1003, 17 Dec 2010

  • Added support for ImageUSB image files. So images of USB drives from ImageUSB can now be mounted.
  • Fixed issue with mounting on a drive letter that is already being used as a network drive
  • Fixed issue with improperly loading/unloading OSFMount driver
  • Fixed issue with drive icon remaining in Windows Explorer even after dismounting

v1.4.1002, 15 Dec 2010

  • Fixed issue with large physical memory usage for non-raw images
  • Fixed issue with incorrectly detecting MBR
  • Added status window for analyzing images before mounting
  • Optimized loading of AFF images
  • Synced with afflib-3.6.4

v1.4.1001, 8 Dec 2010

  • Error checking for NTFS partition size / image size mismatch and code to try and deal with it
  • Error checking for encrypted AFF images
  • Support for AFF directories (AFD)
  • Updated OSFMount logo

v1.4.1000, 6 Dec 2010

  • Support for split raw, AFF, VMWare images .VMDK, CD ISO images
  • Various minor bug fixes

v1.3.1000, 25 Oct 2010

  • First version based on ImDisk V1.3 by Olof Lagerkvist. Branched to support forensic file formats.
Conference banner