VFC allows a forensic disk image to be quickly started as a virtual machine. This allows the investigator to experience the original computing environment, as seen by a suspect. VFC supports a variety of third-party image mount tools. It also includes the very capable built-in tool VFC Mount. A free edition of this mount tool is available on this website. This may be used by forensic investigators, teachers and students to mount forensic images and explore the contents.
VFC Mount is used to mount a forensic disk image as an emulated physical disk. Once mounted, the emulated disk is, for most purposes, indistinguishable from the original physical disk. Such a disk may be examined, re-imaged or started as a virtual machine (using VFC). The mount operation is always read-only and is therefore completely forensically safe. We have optimised VFC Mount for use with VMware and it includes several features to maximise compatibility and to avoid common compatibility problems
The following common image formats are supported by VFC Mount:
Download VFC Mount - CLICK HERE!
VFC Mount is simple to use and includes a comprehensive instruction guide. To mount an image, proceed as follows:
If necessary, you can mount multiple images with VFC Mount. To do this, simply click Mount again and select the desired image. This technique may be necessary when virtualising systems that had multiple physical disks installed. TIP: We recommend mounting all applicable images before using VFC to create a virtual machine.
Once you are finished with a mounted drive, simply highlight the no-longer-required images and click Unmount. If necessary, you can select multiple drives by using Control+Shift:
TIP: Please remember that when you unmount an image it is equivalent to unplugging a physical disk. Any software that is using that mounted image will immediately fail. We recommend you leave images mounted until all software (such as VMware) is closed. It is not necessary to unmount images before shutting down the workstation; this will happen automatically when you log out of Windows.
