How to use the command xmount (with examples)

The xmount command is used to convert on-the-fly between multiple input and output hard disk image types with optional write cache support. It creates a virtual file system using FUSE (Filesystem in Userspace) that contains a virtual representation of the input image. This command is helpful in working with different image formats and allows for easy mounting and manipulation of image files.

Use case 1: Mount a .raw image file into a DMG container file

Code:

xmount --in raw path/to/image.dd --out dmg mountpoint

Motivation: The motivation for using this example is to convert a .raw image file to a DMG container file format. This can be useful when working with different image formats and requires a file system mounted from a DMG container file.

Explanation:

• --in raw path/to/image.dd: Specifies the input image file, which is in .raw format.
• --out dmg: Specifies the output file format, which will be a DMG container file.
• mountpoint: Specifies the directory where the virtual file system should be mounted.

Example output: The input .raw image file will be converted and mounted as a DMG container file in the specified mountpoint directory.

Use case 2: Mount an EWF image file with write-cache support into a VHD file to boot from

Code:

xmount --cache path/to/cache.ovl --in ewf path/to/image.E?? --out vhd mountpoint

Motivation: The motivation for using this example is to mount and boot from an EWF image file in VHD format with write-cache support. This is useful for forensic purposes or when experimenting with different operating systems within a virtual environment.

Explanation:

• --cache path/to/cache.ovl: Specifies a write-cache file to be used.
• --in ewf path/to/image.E??: Specifies the input EWF image file, where ?? represents the specific EWF segment(s) to be used.
• --out vhd: Specifies the output file format, which will be a VHD file.
• mountpoint: Specifies the directory where the virtual file system should be mounted.

Example output: The EWF image file will be mounted as a VHD file in the specified mountpoint directory, allowing for booting and accessing the contents within a virtual environment.

Use case 3: Mount the first partition at sector 2048 into a new .raw image file

Code:

xmount --offset 2048 --in raw path/to/image.dd --out raw mountpoint

Motivation: The motivation for using this example is to extract and mount the first partition of a disk image file into a new .raw image file. This can be useful when recovering data or analyzing specific partitions within disk image files.

Explanation:

• --offset 2048: Specifies the sector offset to start the mounting process. In this example, it starts at sector 2048.
• --in raw path/to/image.dd: Specifies the input image file, which is in .raw format.
• --out raw: Specifies the output file format, which will be a new .raw image file.
• mountpoint: Specifies the directory where the virtual file system should be mounted.

Example output: The first partition, starting from sector 2048, will be mounted and saved as a new .raw image file in the specified mountpoint directory, preserving the data and file system structure within that partition.

Conclusion:

The xmount command is a versatile tool for converting and mounting different types of disk image files. With its support for various image formats, write-cache options, and the ability to specify file system offsets, it provides flexibility for forensic analysis, data recovery, and virtualization purposes. The examples provided demonstrate how the command can be used to achieve specific objectives, such as converting image formats, booting from virtual disks, and manipulating specific partitions within disk image files.