Arsenal Image Mounter

Many tools can open an image. AIM's difference is that it presents the image to Windows as a real disk, which means the operating system's own drivers handle the file system and features such as Volume Shadow Copies behave as they would on the original hardware. Writes are allowed in a temporary mode that records them in a differencing file, leaving the image untouched. The maker lists raw, forensic and virtual machine disk images, optical images and archives as inputs and the ability to identify, unlock, decrypt or suspend BitLocker volumes where the key or password is available.

Professional Mode is where the tool becomes an investigative platform. It can launch a disk image, a physical disk or a remote disk as a virtual machine, with bypasses for Windows authentication, DPAPI and S Mode so an examiner can see the system as the user saw it. It adds further shadow copy options, a file system driver bypass, Recon Reports and remote disk access through an agent. For an Indian lab the practical gain is in demonstration: showing a court what a desktop looked like is often more persuasive than a table of artefacts, provided the examiner records that the virtual machine is a reconstruction and not the original.