Arsenal Image Mounter¶
What Arsenal Image Mounter does¶
Controlled image presentation
Arsenal Image Mounter presents supported disk images to Windows as virtual disks. This allows File Explorer and compatible analysis tools to inspect partitions and files without restoring the image to physical media.
For beginner forensic examination, prefer Disk device, read only. A mount changes the analysis workstation and exposes a representation of the image; it does not prove the source image is authentic or unchanged. Verify the image and working copy before mounting, then record the selected mode and assigned drives.
Choose your journey¶
01Install and openStage AIM, satisfy dependencies and install the virtual SCSI driver.Complete when AIM opens without an error after restart.Beginner · Administrator · 15–30 min 02Mount and verifyMount a verified working image read-only and record the exposed volumes.Complete when the image is inspected and cleanly unmounted.Practical · Training image · 15–25 min 03Hands-on LabsPractise the interface or complete an evidence-driven Full Lab.Complete when another analyst can reproduce your mount.Guided · 15–75 min
Evidence workflow¶
Default route
Read-only disk device¶
Present partitions through Windows storage drivers while preventing writes to the mounted image through the selected AIM mode.
Investigation boundary
Inspect, do not alter¶
Browse and collect observations from a verified working copy. Export recovered material to separate controlled storage.
Evidence record
Preserve context¶
Retain image identity and hash, AIM version, mount mode, drive letters, times, BitLocker state, errors and the unmount result.
Writable modes require a separate purpose
AIM offers temporary write-overlay and original-writing modes for specialist workflows. They add state and risk. Do not use them merely to browse or recover evidence, and never write to the protected original image.