Digital Forensics and Incident Response | DFIR
  • Blog
  • Infosec
  • Windows Forensics
  • Mac Forensics
  • Memory Forensics
  • Incident Response
  • CISSP

How to mount an APFS Image?

7/20/2019

0 Comments

 
Step -1
sudo mkdir /Volumes/apfs_disk_image/
Step -2
sudo mkdir /Volumes/apfs_disk_mount/
Step -3
sudo xmount --in ewf --out dmg /Users/<Username>/APFS/apfs_disk.E01 /Volumes/apfs_disk_image/  
Step-4
hdiutil attach -nomount /Volumen/apfs_disk_image/apfs_disk.dmg
Step-5 
diskutil ap list
Step -6 (Optional)In case of encryption use this: 
diskutil ap unlockVolume <Disk Guid> -nomount
Step-7
sudo mount_apfs  -o rdonly,noexec,noowners /dev/disk#/Volumes/apfs_disk_mount/
0 Comments



Leave a Reply.

    Archives

    July 2019
    April 2018

    Categories

    All
    Plist

    RSS Feed