Mounting Images/Volumes in Linux

To mount an image file/volume in the most forensically sound manner I would suggest the following options be passed to the mount command.

ro read only
noexec do not execute files
noatime do not update last access times
show_sys_files show ntfs system files ( needed to see the $MFT file)


To mount a image file we need to pass an additional option the loop option. The command to mount a NTFS partition on the loop back device to the mount directory evidence would be;

mount -t ntfs-3g -o loop,ro,show_sys_files,noexec,noatime imagefile.dd /mnt/evidence

The same command to mount an NTFS partition connected as the first SATA drive on the system;

mount -t ntfs-3g -o loop,ro,show_sys_files,noexec,noatime imagefile.dd /mnt/evidence