NAME

       xmount - Tool to crossmount between multiple input and output harddisk image files

SYNOPSIS

       xmount [[fopts] [mopts]] <ifile> [<ifile> [...]] <mntp>

DESCRIPTION

       xmount  allows  you to convert on-the-fly between multiple input and output harddisk image
       types. xmount creates a virtual file system using  FUSE  (Filesystem  in  Userspace)  that
       contains a virtual representation of the input image. The virtual representation can be in
       raw DD, VirtualBox's virtual disk file format, Microsoft's Virtual Hard Disk Image  format
       or  in  VmWare's  VMDK  file  format.  Input  images  can  be  raw DD, EWF (Expert Witness
       Compression Format) or AFF (Advanced Forensic Format)  files.  In  addition,  xmount  also
       supports virtual write access to the output files that is redirected to a cache file. This
       makes it possible to boot acquired harddisk images using QEMU, KVM, VirtualBox, VmWare  or
       alike.

OPTIONS

       fopts: (Options specific to FUSE)
         -d: Enable FUSE's and xmount's debug mode.
         -h: Display this help message.
         -s: Run single threaded.
         -o no_allow_other: Disable automatic addition of FUSE's allow_other option.
         -o <fmopts> :
           Specify fuse mount options. Will also disable automatic addition of FUSE's
           allow_other option!
         INFO: For VMDK emulation, you have to uncomment "user_allow_other" in
               /etc/fuse.conf or run xmount as root.
       mopts: (Options specific to xmount)
         --cache <file> :
           Enable virtual write support and set cachefile to use.
         --in <type> :
           Specify input image type. Type can be "dd" or "ewf".
         --info :
           Print out some infos about used compiler and libraries.
         --out <type> :
           Specify output image type. Type can be "dd", "vdi", "vhd", "vmdk(s)".
         --owcache <file> :
           Same as --cache <file> but overwrites existing cache.
         --rw <cache_file> :
           Same as --cache.
         --version :
           Same as --info.
         INFO: Input and output image type defaults to "dd" if not specified.
       ifile:
         Input image file. If you use EWF files, you have to specify all image
         segments! (If your shell supports it, you can use .E?? as file
         extension to specify them files)
       mntp:
         Mount point where virtual files should be located.

BUGS

       Hopefully none. If you find any, please e-mail to <bugs@pinguin.lu>.

EXAMPLE

       To  xmount  an  EWF  image  from  your acquired disk as a raw DD image under /mnt, use the
       following command:

         xmount --in ewf ./acquired_disk.E?? /mnt

       To xmount the same ewf image as vdi file, you would use a command like this:

         xmount --in ewf --out vdi ./acquired_disk.E?? /mnt

       And to enable virtual write support on a raw DD input image xmounted as VDI file:

         xmount --out vdi --cache ./acquired_disk.cache ./acquired_disk.dd /mnt