mount_image
Mount an E01 forensic image using ewfmount and kpartx to prepare for file-system analysis.
Instructions
Mount the E01 forensic image using ewfmount + kpartx. Required before any file-system analysis.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| image_path | No | Path to .E01 file on SIFT VM (optional, uses default) |