With target-mount you can mount the filesystem of a target to an arbitrary directory on your analysis machine, similar to the mount command on Unix systems.

target-mount has two required positional arguments:

  • TARGET - Target to mount

  • MOUNT - Directory to mount the target’s filesystem on

The following example command can be used to mount a target to the directory mnt:

$ target-mount targets/EXAMPLE.vmx ~/mnt/EXAMPLE
## In a different shell
$ ls ~/mnt/EXAMPLE/
disks   fs   volumes

When mounting a target using target-mount the process is kept in the foreground. This will occupy your current terminal session. It is recommended to either open a second terminal, let this command run in the background by appending & to the command or use a terminal multiplexer like tmux to start a second session. Using one of these methods enables you to interact with the mount point.

In the example above we mounted a VMware virtual machine. When looking at the directory listing of the mount point, you will notice the folders disks, fs, and volumes.

  • The disks folder exposes the raw disks found by target-mount within the container file (in this case, one or more VMDK files).

  • The fs folder exposes the filesystem folder hierarchy divided in their respective root folder.

  • The volumes folder exposes the raw volumes found by target-mount (in this case, Windows NTFS volumes).

See also

Please refer to Use-cases for more examples of how to use target-mount.


target-mount - CLI interface#

target-mount [-h] [-o OPTIONS] [-K KEYCHAIN_FILE] [-Kv KEYCHAIN_VALUE] [-v] [-q]
             [--plugin-path PLUGIN_PATH [PLUGIN_PATH ...]]
             TARGET MOUNT

target-mount positional arguments#

  • TARGET - target to load (default: None)

  • MOUNT - path to mount to (default: None)

target-mount optional arguments#

  • -h, --help - show this help message and exit

  • -o OPTIONS, --options OPTIONS - additional FUSE options (default: None)

  • -K KEYCHAIN_FILE, --keychain-file KEYCHAIN_FILE - keychain file in CSV format (default: None)

  • -Kv KEYCHAIN_VALUE, --keychain-value KEYCHAIN_VALUE - passphrase, recovery key or key file path value (default: None)

  • -v, --verbose - increase output verbosity (default: 0)

  • -q, --quiet - do not output logging information

  • --plugin-path PLUGIN_PATH - a file or directory containing plugins and extensions (default: None)

For more information on the -K, --keychain-file and -Kv, --keychain-value arguments, please refer to Disk encryption (FVE).