target-mount you can mount the filesystem of a target to an arbitrary directory on your analysis machine,
similar to the
mount command on Unix systems.
target-mount has two required positional arguments:
TARGET- Target to mount
MOUNT- Directory to mount the target’s filesystem on
The following example command can be used to mount a target to the directory
$ target-mount targets/EXAMPLE.vmx ~/mnt/EXAMPLE ## In a different shell $ ls ~/mnt/EXAMPLE/ disks fs volumes
When mounting a target using
target-mount the process is kept in the foreground. This will occupy your current
terminal session. It is recommended to either open a second terminal, let this command run in the background by
& to the command or use a terminal multiplexer like
tmux to start a second session. Using one
of these methods enables you to interact with the mount point.
In the example above we mounted a VMware virtual machine. When looking at the directory listing of the mount point,
you will notice the folders
disksfolder exposes the raw disks found by
target-mountwithin the container file (in this case, one or more VMDK files).
fsfolder exposes the filesystem folder hierarchy divided in their respective root folder.
volumesfolder exposes the raw volumes found by
target-mount(in this case, Windows NTFS volumes).
Please refer to Use-cases for more examples of how to use
target-mount - CLI interface#
target-mount [-h] [-o OPTIONS] [-K KEYCHAIN_FILE] [-Kv KEYCHAIN_VALUE] [-v] [-q] [--plugin-path PLUGIN_PATH [PLUGIN_PATH ...]] TARGET MOUNT
target-mount positional arguments#
target-mount optional arguments#
OPTIONS- additional FUSE options (default:
KEYCHAIN_FILE- keychain file in CSV format (default:
KEYCHAIN_VALUE- passphrase, recovery key or key file path value (default:
PLUGIN_PATH- a file or directory containing plugins and extensions (default:
For more information on the
--keychain-value arguments, please refer to
Disk encryption (FVE).