NAME

       xmount - Tool to crossmount between multiple input and output harddisk image files

SYNOPSIS

       xmount [fopts] <xopts> <mntp>

DESCRIPTION

       xmount  allows  you to convert on-the-fly between multiple input and output harddisk image
       formats. xmount creates a virtual file system using FUSE (Filesystem  in  Userspace)  that
       contains a virtual representation of the input image.

       The virtual representation can be in raw DD, Apple's Disk Image format (DMG), VirtualBox's
       virtual disk file format (VDI), Microsoft's Virtual Hard Disk Image  format  (VHD)  or  in
       VmWare's VMDK file format.

       Input  images  can  be  raw  DD,  EWF  (Expert  Witness Compression Format), AFF (Advanced
       Forensic Format v3 & possibly v4 (check xmount  --info)),  VDI  (VirtualBox  Virtual  Disk
       Image) or QCOW (QEMU Copy On Write) files.

       It  is  also  possible  to  apply  morphing functions to input images. You can for example
       combine multiple input images into one output image, or reconstruct raids on-the-fly.

       And finally, xmount also supports virtual  write  access  to  the  output  files  that  is
       redirected  to a cache file. This makes it possible to boot acquired harddisk images using
       QEMU, KVM, VirtualBox, VmWare or alike.

OPTIONS

       fopts: (Options specific to FUSE)
         -d: Enable FUSE's and xmount's debug mode.
         -h: Display this help message.
         -s: Run single threaded.
         -o no_allow_other: Disable automatic addition of FUSE's allow_other option.
         -o <fmopts> :
           Specify fuse mount options. Will also disable automatic addition of FUSE's
           allow_other option!

       xopts: (Options specific to xmount)
         --cache <cfile> : Enable virtual write support.
           <cfile> specifies the cache file to use.
         --in <itype> <ifile> : Input image format and source file(s). May be specified  multiple
       times.
           For  a list of supported <itype> types, run xmount --info and look under "loaded input
       libraries".
           <ifile> specifies the source file. If your image is split  into  multiple  files,  you
       have to specify them all!
         --inopts <iopts> : Specify input library specific options.
           <iopts> specifies a comma separated list of key=value options.
         --info : Print out infos about used compiler and loaded libraries.
         --morph  <mtype>  :  Morphing  function  to  apply  to input image(s). If not specified,
       defaults to "combine".
           For a list of supported <mtype> types,  run  xmount  --info  and  look  under  "loaded
       morphing libraries".
         --morphopts <mopts> : Specify morphing library specific options.
           <mopts> specifies a comma separated list of key=value options.
         --offset <off> : Move the output image data start <off> bytes into the input image(s).
         --out <otype> : Output image format. If not specified, defaults to "raw".
           <otype> can be "raw", "dmg", "vdi", "vhd", "vmdk", "vmdks".
         --owcache <file> : Same as --cache <file> but overwrites existing cache file.
         --rocache <file> : Same as --cache <file> but does **not** allow further writes.
         --sizelimit  <size> : The data end of input image(s) is set to no more than <size> bytes
       after the data start.
         --version : Same as --info.

       mntp:
         Mount point where virtual files should be located.

BUGS

       Hopefully none. If you find any, please e-mail to <bugs@sits.lu>.

EXAMPLE

       To xmount an EWF image from your acquired disk as a raw  DD  image  under  /mnt,  use  the
       following command:

         xmount --in aewf ./acquired_disk.E?? /mnt

       To xmount the same ewf image as vdi file, you would use a command like this:

         xmount --in aewf ./acquired_disk.E?? --out vdi /mnt

       And to enable virtual write support on a raw DD input image xmounted as VDI file:

         xmount --in raw ./acquired_disk.dd --out vdi --cache ./disk.cache /mnt