Why can't I access mounted drives in Windows?

Normally, when a disk is mounted to a drive letter (via OSFMount or another mount tool) in Windows, the files and folders of the file system is accessible in Windows Explorer. In some cases, however, Windows does not recognize the file system on the partition and the user is prompted with an error message and/or a prompt to format the disk. This can occur because of the following:

• The mounted drive does not contain a Windows-recongizable file system (ie. NTFS/FAT)
• The file system is corrupted
• The file system permissions prevent the drive from being accessed

If you are absolutely sure that the drive contains a Windows-recognizable, non-corrupted file system and the drive is mounted as read-only, there is a chance that the security permission (ownership) of the file system is blocking the drive from being accessed. In some cases, this can be reset automatically by mounting the drive as read-write. Of course, you should always make backup copies of the drive before mounting it as read-write.

Keep in mind however, if you are merely looking to access the contents of the drive, there is no need to mount the disk in the first place. In computer forensics, it is always best practice to forensically image (i.e., clone), the source disk using a tool such as You can determine which partitioning scheme a disk is using by looking at it with the ‘Raw Disk Viewer' module in OSForensics, then simply add the forensic disk image to your case in OSForensics. You can then use the File System Browser module within OSForensics to browse the files and folders in the file system by analyzing the forensic image and not the actual source disk or evidence disk. This method protects the forensic integrity of the source drive by ensuring no unnecessary writes (i.e., changes) occur to the source drive.