xmount(1)							      xmount								 xmount(1)

NAME

       xmount - Tool to crossmount between multiple input and output harddisk image files

SYNOPSIS

       xmount [[fopts] [mopts]] <ifile> [<ifile> [...]] <mntp>

DESCRIPTION

       xmount  allows you to convert on-the-fly between multiple input and output harddisk image types. xmount creates a virtual file system using
       FUSE (Filesystem in Userspace) that contains a virtual representation of the input image. The virtual representation can be in raw DD, Vir-
       tualBox's virtual disk file format, Microsoft's Virtual Hard Disk Image format or in VmWare's VMDK file format. Input images can be raw DD,
       EWF (Expert Witness Compression Format) or AFF (Advanced Forensic Format) files. In addition, xmount also supports virtual write access	to
       the  output  files that is redirected to a cache file. This makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox,
       VmWare or alike.

OPTIONS

       fopts: (Options specific to FUSE)
	 -d: Enable FUSE's and xmount's debug mode.
	 -h: Display this help message.
	 -s: Run single threaded.
	 -o no_allow_other: Disable automatic addition of FUSE's allow_other option.
	 -o <fmopts> :
	   Specify fuse mount options. Will also disable automatic addition of FUSE's
	   allow_other option!
	 INFO: For VMDK emulation, you have to uncomment "user_allow_other" in
	       /etc/fuse.conf or run xmount as root.
       mopts: (Options specific to xmount)
	 --cache <file> :
	   Enable virtual write support and set cachefile to use.
	 --in <type> :
	   Specify input image type. Type can be "dd" or "ewf".
	 --info :
	   Print out some infos about used compiler and libraries.
	 --out <type> :
	   Specify output image type. Type can be "dd", "vdi", "vhd", "vmdk(s)".
	 --owcache <file> :
	   Same as --cache <file> but overwrites existing cache.
	 --rw <cache_file> :
	   Same as --cache.
	 --version :
	   Same as --info.
	 INFO: Input and output image type defaults to "dd" if not specified.
       ifile:
	 Input image file. If you use EWF files, you have to specify all image
	 segments! (If your shell supports it, you can use .E?? as file
	 extension to specify them files)
       mntp:
	 Mount point where virtual files should be located.

BUGS

       Hopefully none. If you find any, please e-mail to <bugs@pinguin.lu>.

EXAMPLE

       To xmount an EWF image from your acquired disk as a raw DD image under /mnt, use the following command:

	 xmount --in ewf ./acquired_disk.E?? /mnt

       To xmount the same ewf image as vdi file, you would use a command like this:

	 xmount --in ewf --out vdi ./acquired_disk.E?? /mnt

       And to enable virtual write support on a raw DD input image xmounted as VDI file:

	 xmount --out vdi --cache ./acquired_disk.cache ./acquired_disk.dd /mnt

Gillen Daniel							    May 9, 2012 							 xmount(1)