Arsenal Image Mounter
Arsenal Recon · 2026
Access and status
Cost
Paid
Costs money to buy outright — a book, a licence, a registration.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A Windows tool that mounts raw, forensic, and virtual machine disk images as complete physical disks rather than as individual volumes, which is what lets Windows and other software treat an image as a real attached drive. It also offers Windows authentication bypass, launching virtual machines from volume shadow copies, and BitLocker handling.
Who it is for, and when
Mounting as a full disk is the point: it makes volume shadow copies, BitLocker volumes, and dynamic disks accessible to ordinary Windows tools, and it lets you boot a suspect image in a VM to see the environment as the user saw it. That last capability is disproportionately useful in expert work, where explaining what a user would have seen on screen is often more persuasive than a file listing. The shadow copy access alone recovers earlier states of files that a single-point image appears to have lost.
What it does not cover
This is a mounting and access tool — it acquires nothing, parses no artefacts, and produces no findings. Arsenal's own products page lists an all-tools subscription rather than a free tier, so budget for a licence; open-source mounting via ewfmount is an alternative but does not give you the full-disk, shadow-copy, or boot-to-VM behaviour. Booting a suspect image alters the mounted working copy, so the discipline about what is evidence and what is a derived copy has to be yours.
Go to the source
Open at arsenalrecon.com (opens in a new tab)https://arsenalrecon.com/products/
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Publisher
- Arsenal Recon
- Year
- 2026
- Topics
- imaging, evidence-handling, windows, encryption, file-systems
- Checked at source
Related entries
SWGDE's guidance on acquiring data from computers and computer storage, including write blocking, live versus dead acquisition, verification and the handling of encrypted and self-encrypting media. The version verified here is 17-F-002-2.1 dated 5 August 2025.
NIST's guidance on seizing, preserving, acquiring and examining mobile phones and their associated media, including the acquisition-level model (manual, logical, physical, chip-off, JTAG) that practitioners still use as shared vocabulary. It supersedes the 2007 first edition of SP 800-101.
The acquisition half of the job done properly with Linux command-line tools: write protection, image formats, attaching subject media, image management and transfer, integrity by cryptographic and piecewise hashing, PKI signatures and RFC 3161 timestamping, drive security (ATA passwords, Opal self-encrypting drives, BitLocker, FileVault), and difficult cases such as RAID, VM images and damaged media.
FTK Imager
Partly freeA free Windows imaging and preview tool, originally from AccessData and now distributed by Exterro, which acquired the FTK line. It creates raw, E01, and AD1 images, captures live RAM, previews file systems before acquisition, and produces hash verification reports.
A C library and a set of command-line tools (fls, icat, istat, mmls, blkls, tsk_recover and others) that read volume systems and file systems directly from a disk image. It is the engine underneath Autopsy and a component in many other tools.