· forensics volume analysis

Mounting Filesystems

When mounting an image of a journaled filesystem, a couple of shortcuts repeatedly save me time and energy. First, VFAT and NTFS disks reserve (generally) the first 63 sectors for the partition table and meta info. Considering 512 is a very common size for sectors, 32256 becomes a very good number to remember.

32256 is the number of bytes you generally need to offset when mounting a volume.

This offset is done in mount as follows:

  • LinkedIn
  • Tumblr
  • Reddit
  • Google+
  • Pinterest
  • Pocket