OSFMount is a free utility designed for use with PassMark OSForensics™
OSFMount allows you to mount local disk image files (bit-for-bit copies of a disk partition) in Windows with a drive letter. You can then analyze the disk image file with PassMark OSForensics™ by using the mounted volume's drive letter. By default, the image files are mounted as read only so that the original image files are not altered.
OSFMount also supports the creation of RAM disks, basically a disk mounted into RAM. This generally has a large speed benefit over using a hard disk. As such this is useful with applications requiring high speed disk access, such a database applications, games (such as game cache files) and browsers (cache files). A second benefit is security, as the disk contents are not stored on a physical hard disk (but rather in RAM) and on system shutdown the disk contents are not persistent.
OSFMount supports mounting images of CDs in .ISO format , which can be useful when a particular CD is used often and the speed of access is important.
Please click below to download the OSFMount V1.5.1015 installation package
Supported File Extensions
OSFMount supports the mounting of the following Windows image file formats:
|Image Format||Read||Write||Mount as RAM drive||Convert to Image file||Extend||Format|
|Raw Image (.IMG, .DD)|
|Raw CD Image (.ISO, .BIN)|
|Split Raw Image (.00n)|
|Nero Burning ROM Image (.NRG)|
|System Deployment Image (.SDI)|
|Advanced Forensics Format Images* (AFF)|
|Advanced Forensics Format Images w/ meta data* (AFM)|
|Advanced Forensics Format Directories* (AFD)|
|VMWare Image (.VMDK)|
|EnCase EWF (.E01)|
|SMART EWF (.S01)|
|VHD Image (.VHD)|
* The supported version of Advanced Forensics Format is AFFv3 with zlib compression support. Encryption and signatures are not supported.
Windows XP, Vista, Win 7 & Win 8
Windows Server 2000, 2003, 2008
32bit and 64bit support
It is recommended that 64-bit Windows is used when large disk image files are to be mounted. The 32-bit version can only be used on 32-bit Windows. The 64-bit version can only be used on 64-bit Windows.
Users must have administrator privileges.
RAM: 1GB. When mounting large disk images, the more RAM the better.
Disk space: 1 MB of free hard disk space for the installation files.
OSFMount is a free utility.
v1.5.1015, 7 Feb 2014
- Added VHD image file support. VHD is the Virtual Hard Disk file format for disk images, as used by Micrsoft's Virtual PC. This includes support for Dynamic-size (or sparse) hard disk images. Differential images are not supported. Support was added via libvhdi.
- Updated EWF library to libewf-20131230
- Confirmed Win8.1 support
v1.5.1014, 22 Oct 2013
- Fixed issue with detecting partitions for ImageUSB images
- Windows dynamic disks are now supported
- Fixed issue with mounting via OSFMount command line with "-o rw" option
- Fixed issue with mounting multiple partitions in an image file as writable due to file sharing permissions
- Fixed issue with mounting multiple partitions in an image file from command line
- Drive letters 'A' and 'B' can now be used
- Propagated changes from Imdisk v1.7.5 including some key fixes:
- Disks with "lost" drive letters can now be removed
- Notifications hanging on drive creation and removal
v1.5.1013, 7 Mar 2013
- Columns and main window are now resizable
- Added "DEBUGMODE" command line parameter to OSFMount (GUI) for debug logging
- Added "File system (detected)" column in the mounted drive list (for file systems unsupported by OS)
- APM partition scheme is now supported, along with more robust partition detection
v1.5.1012, 27 Dec 2012
- Fixed an issue with logical (extended) partitions not being displayed in the list when selecting a partition
v1.5.1011, 09 May 2012
- Fixed OSFMount driver load error in Win2k3 64-bit
- OSFMount command line now supports setting drive type (eg. CD, HD, FD) via the -o option
v1.5.1010, 03 Apr 2012
- Fixed error when mounting multiple drives backed by the same image file. This includes attempting to mount all partitions from an image file as individual drives.
v1.5.1009, 13 Mar 2012
- Browsing for an image file automatically prompts the user to select a partition
- Changed 'Select Partition' button to a hyperlink
v1.5.1008, 22 Nov 2011
- Added option to mount all partitions in an image to separate drive letters with a single click
v1.5.1007, 27 Jun 2011
- Added option to dismount all drives upon exit of the application
- Fixed OSFMount logo containing incorrect version number
v1.5.1006, 16 Jun 2011
- Added command line support via OSFMount.com console application
- Fixed 'Browse' file dialog to show all file extensions
v1.5.1005, 01 Jun 2011
- Fixed crash when mounting incomplete split files
v1.5.1004, 25 Apr 2011
- Added support for mounting EnCase/SMART images as read/write
- Added support for saving disks as EnCase/SMART images ( .E01 format )
- Fixed issue with mounting larger VMWare images
- Fixed crash when mounting a large image into RAM
v1.5.1003, 21 Apr 2011
- Fixed issue with mounting images split into a large number of files (eg. AFD, E01)
v1.5.1002, 20 Apr 2011
- Added read support for EnCase / SMART EWF format images, typically these have the .E01 file name extension
v1.5.1001, 14 Apr 2011
- Fixed offset/size calculation for images with one partition, which was preventing the mounting of some image files.
v1.5.1000, 16 Mar 2011
- Fixed issue with virtual disks > 4GB. It is now possible to create RAM drives greater than 4GB and not have them corrupt themselves in 64bit
- Fixed issue with memory not deallocating properly when dismounted
- Added support for mounting GUID partition table (GPT) based disks
- Fixed issue with extended partitions
- Improved the add drive window to simplify the options.
v1.4.1005, 27 Jan 2011
- Bug corrected from 1.4.1004 where the mounted drive letter may not appear in Windows Explorer
v1.4.1004, 21 Jan 2011
- Minor corrections
v1.4.1003, 17 Dec 2010
- Added support for ImageUSB image files. So images of USB drives from ImageUSB can now be mounted.
- Fixed issue with mounting on a drive letter that is already being used as a network drive
- Fixed issue with improperly loading/unloading OSFMount driver
- Fixed issue with drive icon remaining in Windows Explorer even after
v1.4.1002, 15 Dec 2010
- Fixed issue with large physical memory usage for non-raw images
- Fixed issue with incorrectly detecting MBR
- Added status window for analyzing images before mounting
- Optimized loading of AFF images
- Synced with afflib-3.6.4
v1.4.1001, 8 Dec 2010
- Error checking for NTFS partition size / image size mismatch and code to try and deal with it
- Error checking for encrypted AFF images
- Support for AFF directories (AFD)
- Updated OSFMount logo
v1.4.1000, 6 Dec 2010
- Support for split raw, AFF, VMWare images .VMDK, CD ISO images
- Various minor bug fixes
v1.3.1000, 25 Oct 2010
- First version based on ImDisk V1.3 by Olof Lagerkvist. Branched to support forensic file formats.