target-mount

With target-mount you can mount the filesystem of a target to an arbitrary directory on your analysis machine, similar to the mount command on Unix systems.

target-mount has two required positional arguments:

  • TARGET - Target to mount

  • MOUNT - Directory to mount the target’s filesystem on

The following example command can be used to mount a target to the directory mnt:

$ target-mount targets/EXAMPLE.vmx ~/mnt/EXAMPLE
## In a different shell
$ ls ~/mnt/EXAMPLE/
disks   fs   volumes

When mounting a target using target-mount the process is kept in the foreground. This will occupy your current terminal session. It is recommended to either open a second terminal, let this command run in the background by appending & to the command or use a terminal multiplexer like tmux to start a second session. Using one of these methods enables you to interact with the mount point.

In the example above we mounted a VMware virtual machine. When looking at the directory listing of the mount point, you will notice the folders disks, fs, and volumes.

  • The disks folder exposes the raw disks found by target-mount within the container file (in this case, one or more VMDK files).

  • The fs folder exposes the filesystem folder hierarchy divided in their respective root folder.

  • The volumes folder exposes the raw volumes found by target-mount (in this case, Windows NTFS volumes).

See also

Please refer to Use-cases for more examples of how to use target-mount.

Usage

target-mount - CLI interface

dissect.target

target-mount [-h] [-o OPTIONS] [-K KEYCHAIN_FILE] [-Kv KEYCHAIN_VALUE] [-L LOADER]
             [--child CHILD] [--children] [--list-children] [--recursive] [-v] [--version]
             [-q] [--plugin-path PLUGIN_PATH [PLUGIN_PATH ...]]
             TARGET MOUNT

target-mount positional arguments

  • TARGET - target to load (default: None)

  • MOUNT - path to mount to (default: None)

target-mount options

  • -h, --help - show this help message and exit

  • -o OPTIONS, --options OPTIONS - additional FUSE options (default: None)

  • -K KEYCHAIN_FILE, --keychain-file KEYCHAIN_FILE - keychain file in CSV format (default: None)

  • -Kv KEYCHAIN_VALUE, --keychain-value KEYCHAIN_VALUE - passphrase, recovery key or key file path value (default: None)

  • -L LOADER, --loader LOADER - select a specific loader (i.e. vmx, raw) (default: None)

  • --child CHILD - load child of target by path of index (see –list-children) (default: None)

  • --children - include children

  • --list-children - list all children indices and paths, then exit (default: False)

  • --recursive - make –list-children behave recursively

  • -v, --verbose - increase output verbosity (default: 0)

  • --version - print version

  • -q, --quiet - do not output logging information

  • --plugin-path PLUGIN_PATH - a file or directory containing plugins and extensions (default: None)

For more information on the -K, --keychain-file and -Kv, --keychain-value arguments, please refer to Disk encryption (FVE).