Definition Req'd


New Member
Oct 12, 2005
Mounting a file system was initially a Unix term, since it required the use of the Unix mount command.

Basically it means making the hard drive/file system available to the user/examiner.



New Member
Nov 30, 2006
mounting images

<t>Images of disk partitions or filesystems can be mounted under various LINUX and UNIX platforms provided the OS kernel has that filesystem support included. Most often people want to mount Win2k NTFS under Linux, standard release kernel do not support NTFS. However, the NTFS modules can be acquired and loaded providing NTFS support.</t>
Jan 11, 2006

Terminology is important, though often muddled. For example, I would argue that the work I do is "data forensics" because I analyze the data, and not "computer forensics" because I'm not analyzing the computer. I also list the contents of a directory, not a folder. And finally, I initialize a file system within a partition, I don't "format" it... ;)

But to help clarify here, you mount block devices. Block devices are file systems. Almost always a file system is contained within a partition, a segment of the physical drive. A drive may have one or more partitions, and each of these partitions may or may not have a file system initialized within it. So 99% of the time when you hear or read "mounting the drive" they're most likely meaning mounting the file system within a partition on the drive. However, like most anything in life, there is the odd case where a device has no partition table (it's not been segmented) and a file system has been initialized against the entire physical device. Good examples of this are USB thumbdrives. You can initialize a file system against the physical device (the thumbdrive).

I hope something here is helpful.


p.s. most Linux distributions ship with NTFS support enabled as a loadable kernel module. A few years back it was true that if you required NTFS support you had to compile the module yourself or install a pre-compiled one. I haven't found a distribution recently where the support isn't there for NTFS. Just a quiet heads up.

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu