APFS is the new file system for Mac OS, and so far, many forensic suites are playing catch up as far as support goes. As such, workarounds may need to be employed in order to conduct analysis on Mac OS APFS images. This short blog post will cover one of those workarounds - mounting an APFS image in Windows.
Paragon has a free (preview) driver to mount APFS volumes in Windows!!!! Sweet!!!
APFS for Windows is going to look for a connected APFS drive. Since we have an image, we will need to mount the image as a SCSI device so the Windows APFS driver can see it. To do this, we will use Arsenal Image Mounter.
Mount the image using Arsenal Image Mounter. I had to select the sector size of 4096 for it to work since the sector size in my image was 4096 (If you need to know the sector size of your image, you can use a tool like mmls to check).
Download and install APFS for Windows from Paragon and launch it. It should automatically detect the APFS volume:
Now you can browse the APFS drive in Windows:
And add it to your favorite all in one tool, like X-Ways, as a logical drive:
Happy Hunting!
Paragon has a free (preview) driver to mount APFS volumes in Windows!!!! Sweet!!!
APFS for Windows is going to look for a connected APFS drive. Since we have an image, we will need to mount the image as a SCSI device so the Windows APFS driver can see it. To do this, we will use Arsenal Image Mounter.
Mount the image using Arsenal Image Mounter. I had to select the sector size of 4096 for it to work since the sector size in my image was 4096 (If you need to know the sector size of your image, you can use a tool like mmls to check).
Download and install APFS for Windows from Paragon and launch it. It should automatically detect the APFS volume:
Now you can browse the APFS drive in Windows:
And add it to your favorite all in one tool, like X-Ways, as a logical drive:
Happy Hunting!
Comments
Post a Comment