Digitvetus Mount

Read-only forensic image mounting for Windows

Mount Image Studio is a desktop application for investigators, examiners, and IT professionals who need to attach disk evidence to Windows quickly and safely. Built with **Qt 6** and native Windows APIs, it focuses on one job: **mount forensic and virtual disk images in read-only mode** so you can browse volumes in Explorer, run your preferred analysis tools, or capture logical copies—without altering the source image.

Inspired by the workflow of commercial tools such as Mount Image Pro (MIP), Mount Image Studio delivers a clear mapped-device list, flexible mount types, and optional command-line automation—while keeping evidence integrity at the center of every design choice.

---

## Why Mount Image Studio?

| Benefit | What it means for you |
|--------|------------------------|
| **Forensic read-only by default** | No write cache, no simulated writes—reduces risk to source evidence. |
| **Native Windows integration** | ISO, VHD, and VHDX use the Windows Virtual Disk API; EnCase and raw images use the industry-standard **WinSpd** stack with **libewf**. |
| **Physical and logical views** | Mount as a whole disk, a drive letter, or both—matching common examiner workflows. |
| **Modern, bilingual UI** | English and Simplified Chinese; drag-and-drop, detail panel, and toolbar shortcuts. |
| **Transparent mapping** | See drive letter or device path, mount method, partition label, and source image in one table. |
| **Automation-friendly** | Command-line mount, batch list files, and unmount-all for scripts and lab playbooks. |

---

## Supported image formats

### Mount today

| Format | Typical extensions | How it is mounted |
|--------|-------------------|-------------------|
| **EnCase E01 / Ex01** | `.e01`, `.ex01` | WinSpd + libewf (Administrator recommended) |
| **EnCase L01 / Lx01** | `.l01`, `.lx01` | WinSpd + libewf (Administrator recommended) |
| **ISO (optical)** | `.iso` | Windows Virtual Disk API |
| **Microsoft VHD / VHDX** | `.vhd`, `.vhdx` | Windows Virtual Disk API |
| **Raw / DD / IMG** | `.dd`, `.raw`, `.img` | WinSpd linear image (512 bytes/sector; Administrator recommended) |

### File System / Read Only (EnCase)

For **E01 and L01** images, you can choose **File System / Read Only**: the image is exposed as a folder containing a read-only **`ewf1`** raw file (via **WinFsp**), ideal when your toolchain opens a flat device file instead of a drive letter. Requires the WinFsp runtime and a build linked with the WinFsp Developer SDK.

### Recognized in the UI (not yet mounted)

AccessData **AD1**, **AFF/AFF4**, Apple **DMG**, VMware **VMDK**, NUIX **MFS01**, X-Ways **CTR**, and several vendor-specific types appear in the file picker for clarity; mounting these formats is on the [roadmap](ROADMAP.md) or depends on external parsers.

---

Core features

Mount types

- "Physical & Logical" — List both the physical device (e.g. `PhysicalDriveN`) and the assigned volume letter when applicable.
- "Physical only" — Block-level device without emphasizing the logical volume row.
- "Logical only" — Focus on the volume / drive letter (or file-system mount point).

Mount methods

- **Block Device / Read Only** — Classic forensic mount: image appears as a disk/volume in Windows. File systems (NTFS, FAT, exFAT, etc.) are interpreted by Windows and any third-party drivers you have installed—not by Mount Image Studio itself.
- **File System / Read Only** — EnCase-only: WinFsp mount point with embedded **`ewf1`** RAW access.

Mapped image list

Each session is tracked in a sortable table:

| Column | Description |
|--------|-------------|
| **Drive** | Letter, `PhysicalDriveN`, mount folder, or `ewf1` |
| **Method** | Block device vs file system |
| **Partition** | Volume or layout hint |
| **Image** | Full path to the source file |

Select a row for a rich detail panel: format, size, hashes (when available from EWF), WinSpd unit ID, physical path, and status messages.

Evidence integrity mode

A persistent banner reminds you that **all mounts are read-only**. On exit, if images are still mapped, you can **Unmount All & Exit**, **Force Close** (leaves OS devices attached—use with care), or cancel.

Tools & administration

- Open **Disk Management** (`diskmgmt.msc`) from the menu.
- **Restart as Administrator** when WinSpd block mounts require elevation.
- **Help → Supported Formats** — In-app summary aligned with [MIP feature matrix](MIP_FEATURE_MATRIX.md).
- **Help → Language** — English / 简体中文.

### Performance and responsiveness

Mount operations run on a **background worker** so the UI stays responsive while WinSpd starts and drive letters are assigned. Startup **environment checks** warn if WinSpd or elevation is missing (optional “do not show again”).

---

## Typical workflow

1. **Launch** Mount Image Studio (elevate when mounting E01 or raw images via WinSpd).
2. **Mount Image** (Ctrl+M) or drag a supported file onto the window.
3. Choose **mount type**, **method**, optional **drive letter**, and **password** for encrypted EWF segments if needed.
4. Review the **mapped list**; open Explorer from the context menu or copy a **physical device path** for low-level tools.
5. Analyze with your forensic suite, imagers, or PowerShell—always read-only from the product’s perspective.
6. **Unmount** selected entries or **Unmount All** before closing, or use the guided exit dialog.

---

## Command-line interface

Mount Image Studio can run headless for scripting:

```text
Mount.exe Launch the GUI
Mount.exe /mount <image> [E:] Mount with optional drive letter
[/type:physical|logical|both]
[/method:block|filesystem]
[/password <secret>]
Mount.exe /mountbatch <list.txt> One image path per line (# comments allowed);
optional drive letter after tab or space (e.g. E:)
Mount.exe /unmountall Dismount all sessions tracked by this run
Mount.exe /? Help
```

Examples:

```text
Mount.exe /mount D:\Cases\disk.E01 E: /readonly
Mount.exe /mount D:\Cases\mem.dd F: /type:both
Mount.exe /mount D:\Evidence\server.E01 /method:filesystem
Mount.exe /mountbatch D:\lab\mount_list.txt
```

---

## System requirements

| Component | Requirement |
|-----------|-------------|
| **OS** | Windows 10/11 x64 |
| **Runtime** | Qt 6.10 (MSVC 2022 x64 build) |
| **WinSpd** | Required for E01/L01 and DD/RAW/IMG block mounts ([winspd.dev](https://github.com/winfsp/winspd)) |
| **WinFsp** | Required for E01 **File System / Read Only** mounts ([winfsp.dev](https://winfsp.dev)) |
| **Privileges** | Administrator recommended for WinSpd-backed block devices |
| **libewf** | Bundled via project build (`mount_winspd_e01` + props); GPL-compatible stack |

Environment variables (optional): `MOUNT_WINSPD_ROOT`, `MOUNT_WINSPD_E01` — see [README](../README.md).

---

## How it compares to Mount Image Pro

Mount Image Studio targets the **same core use case**—quick read-only access to common forensic and virtual disk formats on Windows—without claiming parity with every MIP feature.

**Strengths:** Open workflow (GPL), modern Qt UI, EnCase + ISO/VHD/VHDX + raw in one tool, physical/logical listing, bilingual interface, CLI and batch lists.

**Not included (by design or not yet implemented):** Write cache, deleted-file toggles, BitLocker/FileVault unlock, remote GetData servlet mounts, AD1/AFF/DMG/VMDK mount backends, and proprietary formats such as ProDiscover or SMART. See the full [MIP vs Mount Image Studio matrix](MIP_FEATURE_MATRIX.md).

---

## Licensing and third-party components

Mount Image Studio is released under the **GNU General Public License v3** ([LICENSE](../LICENSE)). Third-party components include **WinSpd** (GPL), **libewf** (LGPL/GPL ecosystem), and optional **WinFsp**. You are responsible for complying with their licenses in redistribution and lab deployment.

---

## Who is it for?

- **Digital forensic examiners** mounting EnCase or raw images for triage in Explorer or downstream tools.
- **Incident response teams** attaching VHD/VHDX or ISO images from hypervisors or collections.
- **Lab administrators** scripting repeatable mount steps with `/mount` and `/mountbatch`.
- **Developers and integrators** who want a readable, extensible Qt codebase on top of WinSpd and virtdisk.

---

## Get started

1. Build from source with Visual Studio and Qt 6.10 (see [README](../README.md)), or use your organization’s packaged build.
2. Install **WinSpd** (and **WinFsp** + Developer SDK if you need File System mounts).
3. Run **Mount.exe** as Administrator when working with E01 or raw block mounts.
4. Open **Help → Supported Formats** inside the app for the latest in-product summary.

---

**Mount Image Studio** — *Evidence integrity mode: all mounts are read-only.*