There two ways to choose an image for mounting in Arsenal Image Mounter.
- You can use the File menu (and choose Mount image...) or
- The Mount image button, as shown in figure 3.10
Figure 3.10. Arsenal Image Mounter main window
- When you choose the Mount image... option from the File menu or click on the Mount image button, the Open window will pop up - here you should choose an image for mounting.
- The next window you will see is Mount options, like the one in figure 3.11.
Figure 3.11. Arsenal Image Mounter Mount options window
As you can see, there are a few options here:
- Read only - if you choose this option, the image is mounted in read-only mode, so no write operations are allowed. (Do you still remember that you mustn't alter the evidence in any way? Of course, it's already an image, not the original drive, but nevertheless.)
- Fake disk signature - if an all-zero disk signature is found on the image, Arsenal Image Mounter reports a random disk signature to Windows, so it's mounted properly.
- Write temporary - if you choose this option, the image is mounted in read-write mode, but all modifications are written not in the original image file, but to a temporary differential file instead.
- Write original - again, this option mounts the image in read-write mode, but this time the original image file will be modified.
- Sector size - this option allows you to choose the sector size.
- Create "removable" disk device - this option emulates the attachment of a USB thumb drive.
- Choose the options you think you need and click OK.
We decided to mount our image as Read Only. Now you can see a hard drive icon on the main window of the tool - the image is mounted.
If you mounted only one image and want to unmount it, select the image and click on Remove selected. If you have a few mounted images and want to unmount all of them, click on the Remove all button.