Practical Forensic Imaging

8SPECIAL IMAGE ACCESS TOPICS

This chapter demonstrates techniques for getting information about disk image files and making them accessible as block devices and as mounted directories. You’ll learn to set up loop devices and create logical devices with device mapper tools. You’ll also explore methods to map or convert software-encrypted disk images, making them accessible by forensic tools. These methods are useful in situations in which the contents of an image cannot be accessed directly and a layer of active translation or decryption is needed. Examples of such images include encrypted filesystems, virtual machine (VM) images, and other image ...