xmount(1)

💖 xmount(1) 💖

okay bestie, sit DOWN, because xmount is about to be your new obsession — this is the xmount manual page, and I'm gonna walk you through it like we're texting at 2am 🦋

---

✨ NAME ✨

xmount — the tool to crossmount between multiple input and output harddisk image files. crossmounting?? it's giving matchmaker but for disk images fr fr 💅

---

🎀 SYNOPSIS 🎀

xmount [fopts] <xopts> <mntp>

---

💜 DESCRIPTION 💜

okay so xmount lets you convert on-the-fly between multiple input and output harddisk image formats. literally while you're using it, no pre-conversion era. 🌈 It creates a virtual file system using FUSE (Filesystem in Userspace) that contains a virtual representation of the input image. virtual representation?? she's that girl.

The virtual representation can be in:

• raw DD
• Apple's Disk Image format (DMG) 🍎
• VirtualBox's virtual disk file format (VDI)
• Microsoft's Virtual Hard Disk Image format (VHD)
• VmWare's VMDK file format

and the input images can be:

• raw DD
• EWF (Expert Witness Compression Format)
• AFF (Advanced Forensic Format v3 & possibly v4 — check xmount --info, iykyk 👀)
• VDI (VirtualBox Virtual Disk Image)
• QCOW (QEMU Copy On Write) files

It is also possible to apply morphing functions to input images. like??? you can combine multiple input images into one output image, or reconstruct raids on-the-fly. raids!! reconstructed!! on-the-fly!! 🔥

And finally — and this is the part that ate, no cap — xmount also supports virtual write access to the output files that is redirected to a cache file. This makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox, VmWare or alike. booting images?? main character energy fr 👑

---

🌸 OPTIONS 🌸

💫 fopts: (Options specific to FUSE) 💫

• -d — Enable FUSE's and xmount's debug mode. 🐛
• -h — Display this help message. bestie needs help sometimes, it's fine 🫶
• -s — Run single threaded.
• -o no_allow_other — Disable automatic addition of FUSE's allow_other option.
• -o <fmopts> — Specify fuse mount options.

⚠️ heads up: this will also disable automatic addition of FUSE's allow_other option! it's a package deal, sorry not sorry 💀

✨ xopts: (Options specific to xmount) ✨

• --cache <cfile> — Enable virtual write support. <cfile> specifies the cache file to use. 🍓
• --in <itype> <ifile> — Input image format and source file(s). May be specified multiple times.

For a list of supported <itype> types, run xmount --info and look under "loaded input libraries".

<ifile> specifies the source file. If your image is split into multiple files, you have to specify them all! not some of them. ALL of them. periodt. 💅

• --inopts <iopts> — Specify input library specific options. <iopts> specifies a comma separated list of key=value options.
• --info — Print out infos about used compiler and loaded libraries. 🧚
• --morph <mtype> — Morphing function to apply to input image(s). If not specified, defaults to "combine".

For a list of supported <mtype> types, run xmount --info and look under "loaded morphing libraries".

• --morphopts <mopts> — Specify morphing library specific options. <mopts> specifies a comma separated list of key=value options.
• --offset <off> — Move the output image data start <off> bytes into the input image(s).
• --out <otype> — Output image format. If not specified, defaults to "raw".

<otype> can be "raw", "dmg", "vdi", "vhd", "vmdk", "vmdks". 🌈

• --owcache <file> — Same as --cache <file> but overwrites existing cache file. 😤
• --rocache <file> — Same as --cache <file> but does not allow further writes.

🔒 read-only girlies, this one's for you. once it's written, it's written. no takebacks.

• --sizelimit <size> — The data end of input image(s) is set to no more than <size> bytes after the data start.
• --version — Same as --info.

🦋 mntp: 🦋

• Mount point where virtual files should be located. 📁

---

💀 BUGS 💀

Hopefully none. 🙈 If you find any, please e-mail to <bugs@sits.lu>. do it, they wanna hear from you, bestie 💌

---

⭐ EXAMPLE ⭐

To xmount an EWF image from your acquired disk as a raw DD image under /mnt, use the following command:

xmount --in aewf ./acquired_disk.E?? /mnt

To xmount the same ewf image as vdi file, you would use a command like this:

xmount --in aewf ./acquired_disk.E?? --out vdi /mnt

And to enable virtual write support on a raw DD input image xmounted as VDI file:

xmount --in raw ./acquired_disk.dd --out vdi --cache ./disk.cache /mnt

see?? three commands and you're literally a forensic disk image girlie now. it's giving effortless. 🎀

---

okay that's the whole page bestie, go forth and crossmount 💖✨🦋

this iconic piece of documentation was written by Daniel Gillen, dated Mar 15, 2024, and it lives in the xmount(1) manual — version and all, we stan an organized queen 👑 💅🌸