target-mount¶
With target-mount
you can mount the filesystem of a target to an arbitrary directory on your analysis machine,
similar to the mount
command on Unix systems.
target-mount
has two required positional arguments:
TARGET
- Target to mountMOUNT
- Directory to mount the target’s filesystem on
The following example command can be used to mount a target to the directory mnt
:
$ target-mount targets/EXAMPLE.vmx ~/mnt/EXAMPLE
## In a different shell
$ ls ~/mnt/EXAMPLE/
disks fs volumes
When mounting a target using target-mount
the process is kept in the foreground. This will occupy your current
terminal session. It is recommended to either open a second terminal, let this command run in the background by
appending &
to the command or use a terminal multiplexer like tmux
to start a second session. Using one
of these methods enables you to interact with the mount point.
In the example above we mounted a VMware virtual machine. When looking at the directory listing of the mount point,
you will notice the folders disks
, fs
, and volumes
.
The
disks
folder exposes the raw disks found bytarget-mount
within the container file (in this case, one or more VMDK files).The
fs
folder exposes the filesystem folder hierarchy divided in their respective root folder.The
volumes
folder exposes the raw volumes found bytarget-mount
(in this case, Windows NTFS volumes).
See also
Please refer to Use-cases for more examples of how to use target-mount
.
Usage¶
target-mount - CLI interface¶
dissect.target
target-mount [-h] [-o OPTIONS] [-K KEYCHAIN_FILE] [-Kv KEYCHAIN_VALUE] [-v] [-q]
[--plugin-path PLUGIN_PATH [PLUGIN_PATH ...]]
TARGET MOUNT
target-mount positional arguments¶
target-mount optional arguments¶
-o
OPTIONS
,--options
OPTIONS
- additional FUSE options (default:None
)-K
KEYCHAIN_FILE
,--keychain-file
KEYCHAIN_FILE
- keychain file in CSV format (default:None
)-Kv
KEYCHAIN_VALUE
,--keychain-value
KEYCHAIN_VALUE
- passphrase, recovery key or key file path value (default:None
)--plugin-path
PLUGIN_PATH
- a file or directory containing plugins and extensions (default:None
)
For more information on the -K
, --keychain-file
and -Kv
, --keychain-value
arguments, please refer to
Disk encryption (FVE).