Arsenal Image Mounter Hands on Labs¶

Practise in the browser, or use the real tool in the Full Lab with a Windows training VM and a small disk image.

Interactive Lab¶

Browser based

Arsenal Image Mounter Interactive Lab

No installation

A project folder has gone missing from workstation WS-07. Your team can examine its disk image. Open the checked working copy read only, find the project note and save a copy outside the image.

This is a practice window based on the AIM screenshots in this guide. It does not mount a real image or install a driver. The drives and folders are examples; hashes come from a small training sample.

Step 1 of 4Select the working image

Start with Mount disk image, then select the working copy listed in your case notes.

1Select
2Mount
3Find the note
4Remove and check

Show hint

Preparing your checked working copy…

Full Lab¶

Self hosted / real image mounting

Windows VM + training image

Case SUSA-IMG-021 / missing project folder

Find the project note in a read only image.

The response team is checking a report of missing project files. It needs a copy of an Aster project note from a disk image. Use AIM to mount a checked copy read only, find that note and save it separately. Then remove the image and show that the working copy stayed unchanged.

Tick each box after saving its files or notes. This page saves your ticks, but cannot check your workstation.

Case brief¶

Your taskFind Users\Alex\Documents\Aster\review-note.txt and give the next analyst a checked export.

What you will use

A disposable Windows analysis VM, AIM, one small training image and separate storage for the working copy, exports and notes.

In this case: examination is approved and the original image is kept separately. The training note is a readable file; this lab does not recover deleted files. In real work, use the actual case scope, source records and handling procedure.

Before you start¶

You need: Windows 11 x64, administrator access, Windows PowerShell 5.1 and AIM installed from the official source. Use a clean VM snapshot and a separate NTFS evidence disk on E: with room for the image copy, export and notes. For this small lab, a 1 GiB training VHD and 10 GiB free on E: are enough. Confirm E: is the intended evidence disk.

Training image: use an instructor provided, single file, unencrypted NTFS VHD at E:\TrainingImages\Aster-training.vhd, containing the agreed note. Record its supplier, acquisition or creation details, sector size and any supplied checksum. Keep it detached before copying or hashing. The commands below use this format to avoid multi file image setup. Do not point AIM at the VM's live system disk.

How to follow: open each step when you reach it and check the Look for result. Keep the PowerShell window open. Allow about 25 to 40 minutes after setup; storage speed affects copying and hashing. The three activities use AIM for mounting, Explorer for browsing, and PowerShell for checks.

No training image? Make a small one on this disposable VM

This creates practice material, not a forensic acquisition. Use only a new VHD you create for this exercise.

Create E:\TrainingImages in Explorer. Check that Aster-training.vhd does not already exist.
Open Disk Management as administrator. Choose Action > Create VHD, set the new path to E:\TrainingImages\Aster-training.vhd, size 1 GB, format VHD and Fixed size.
Identify the newly attached 1 GB virtual disk by its size and VHD path. Initialise only that new disk as GPT. Create a new simple NTFS volume named ASTER-TRAINING, using a free letter such as T:. Do not initialise or format an existing disk. If you cannot clearly identify the new VHD, stop and use an instructor's image.
In Explorer, create T:\Users\Alex\Documents\Aster on that new volume. Create review-note.txt in Notepad with these harmless contents; save it as a text file, not review-note.txt.txt:

ASTER PROJECT - TRAINING NOTE
Access review still pending.
Check the project approval log before drawing conclusions.

Finish by detaching it: close Notepad and every Explorer window using T:. In Disk Management, right click the new virtual disk's left hand label and choose Detach VHD. Leave any option to delete the VHD file unticked. Confirm T: disappears and the .vhd remains on E:. Record that you created it, the volume name, partition layout and 512-byte sector size. Do not keep this writable setup attached while hashing or mounting it in AIM.

AIM setup, supported environments and terms

Follow Install and open for the runtime and virtual SCSI driver. Record installation prompts and restart the analysis machine if requested. Check the requirements for your downloaded build. Arsenal recommends a physical Windows workstation for full functionality; VM behaviour varies. This training VM exercises basic mounting, not AIM's VM launch features. If its driver will not load, use a compatible training workstation rather than disabling Windows protections.

A disk image holds a disk's copied contents. AIM presents those contents to Windows like an attached disk. Read only means writes to the mounted image are blocked. A working copy is the copy you examine. A SHA-256 hash is a fingerprint calculated from file contents. A matching hash checks those contents; it does not prove every part of the original disk was captured.

These blocks hash the whole single VHD file. They do not calculate a decoded disk data checksum inside an E01 container. For a real multi file VMDK or segmented E01, preserve and check the complete set using the appropriate image verification workflow.

Activity 1: Prepare the copy¶

First resultA checked working copy and a record of where the image came from.

1. Copy the detached image into a new case folder

Open Windows PowerShell as administrator. Confirm the original training VHD is detached in Disk Management. Change $aimOriginal if your instructor supplied a different location. Use a new case folder each time; this block refuses to overwrite an earlier case.

$aimCase = 'E:\SUSA-IMG-021'
$aimOriginal = 'E:\TrainingImages\Aster-training.vhd'
$aimTools = 'C:\Tools\Arsenal Image Mounter'
if ($PSVersionTable.PSVersion.ToString() -notlike '5.1.*') { throw 'Open Windows PowerShell 5.1.' }
$aimSource = Get-Item -LiteralPath $aimOriginal -ErrorAction Stop
if ($aimSource.Extension -ne '.vhd' -or $aimSource.Length -eq 0) { throw 'Use the detached, single-file training VHD.' }
$aimDisk = Get-Volume -DriveLetter E -ErrorAction Stop
if ($env:SystemDrive -eq 'E:' -or $aimDisk.FileSystem -ne 'NTFS') { throw 'Use the intended separate NTFS evidence disk on E:.' }
if ($aimDisk.SizeRemaining -lt ($aimSource.Length + 1GB)) { throw 'Allow room for the image copy, export and notes.' }
if (Test-Path -LiteralPath $aimCase) { throw 'Case folder already exists. Keep it and choose a new folder.' }
New-Item -ItemType Directory -Path "$aimCase\working", "$aimCase\exports", "$aimCase\notes" -ErrorAction Stop | Out-Null
$aimWorking = "$aimCase\working\Aster-training.vhd"
$aimOriginalHash = Get-FileHash -Algorithm SHA256 -LiteralPath $aimOriginal -ErrorAction Stop
Copy-Item -LiteralPath $aimOriginal -Destination $aimWorking -ErrorAction Stop
$aimBefore = Get-FileHash -Algorithm SHA256 -LiteralPath $aimWorking -ErrorAction Stop
@($aimOriginalHash, $aimBefore) | Export-Csv -LiteralPath "$aimCase\notes\before-mount-sha256.csv" -NoTypeInformation
if ($aimOriginalHash.Hash -ne $aimBefore.Hash) { throw 'Copy hash differs. Keep the check and stop before mounting.' }
$aimOs = Get-CimInstance Win32_OperatingSystem
@(
    'Case: SUSA-IMG-021; permission: this training image only'
    "Examiner: $env:USERNAME; analysis computer: $env:COMPUTERNAME"
    "Windows: $($aimOs.Caption); build: $($aimOs.BuildNumber)"
    "UTC: $((Get-Date).ToUniversalTime().ToString('o')); time zone: $((Get-TimeZone).Id)"
    "Original: $aimOriginal; bytes: $($aimSource.Length); format: single VHD"
    "Working copy: $aimWorking"
    'Task: find Users\Alex\Documents\Aster\review-note.txt; save a separate copy'
) | Set-Content -LiteralPath "$aimCase\notes\case-context.txt"
Get-Content -LiteralPath "$aimCase\notes\case-context.txt"
@($aimOriginalHash, $aimBefore) | Format-Table Path, Hash -AutoSize

Look for: two matching hashes and the new working, exports and notes folders. If your instructor supplied a VHD file checksum, compare it with the original hash too. A mismatch needs investigation; copying two identical files does not fix an incorrect source image.

2. Finish the starting notes and check AIM

Open case-context.txt and add the image's source, creation/acquisition date, supplied checksum and result, and the permission for this task. If you made the VHD, say so; do not describe it as an acquired workstation image.

Open AIM as administrator. Record its actual version from Help/About, or the executable's file details if your build presents it differently. Add the download URL, archive name and date to your notes. Confirm it opens with no driver error and no image attached. Compare the main window with the installation reference.

Look for: a source record, actual AIM version and a checked working path ready to use. Do not use the original path in the next activity.

Ready to mount I kept the source image, saved the two hashes and confirmed the copy matches. I recorded the image source, permission, workstation, time zone and AIM version.Pause point: keep the case folder. In a new PowerShell window, set $aimCase = 'E:\SUSA-IMG-021', $aimOriginal = 'E:\TrainingImages\Aster-training.vhd' and $aimWorking = "$aimCase\working\Aster-training.vhd" using your actual paths. Do not rerun the new case block.

Next: mount the copy and find the agreed file.

Continue to mounting

Activity 2: Mount and find¶

Next resultThe project note, saved outside the image with its source path and hash.

1. Mount the working copy read only

In AIM, select Mount disk image and open E:\SUSA-IMG-021\working\Aster-training.vhd. In Mount options, choose Disk device, read only. Use the sector size documented for the training image; the VHD made above uses 512. Leave extra options off unless the image's instructions require them. Select OK.

Record the UTC mount time, image path, exact mode, sector size, options and all drive letters AIM lists. Take a screenshot of the mounted image row. Your letters may differ from the browser lab's F:/G:/H:; a small single volume VHD may expose just one drive. Do not assume F: belongs to your image.

Look for: the working image listed in AIM and a readable NTFS volume. If Windows asks to initialise or format a disk, cancel that prompt and inspect the image and settings. Do not format the mounted evidence.

No drive letter, or access denied?

Keep AIM's messages and screenshot. Check that you selected the complete working image, its correct sector size and the expected partition. Encryption or missing file system support can prevent browsing. Read only mode does not bypass Windows permissions. Do not take ownership or run repair commands on evidence to force this exercise to work. Use the known training VHD, or ask the instructor to resolve its setup. Write temporary and driver bypass workflows need separate instructions and records.

2. Find the note and save a checked export

Open the volume through AIM's drive link. Use Explorer to follow Users\Alex\Documents\Aster. Read only the agreed review-note.txt. If it is missing, record that result and the path checked; do not invent a finding or browse unrelated files to finish a checklist.

In the same PowerShell window, edit $aimVolume to the drive you just confirmed in AIM. These commands copy the note to your case folder and compare hashes of the source file and export. They also record its size and times. A file's modification time is not its deletion time.

$aimVolume = 'F:' # Change this to the actual volume shown for your image in AIM.
if ($aimVolume -notmatch '^[A-Za-z]:$' -or $aimVolume -eq $env:SystemDrive -or $aimVolume -eq 'E:') { throw 'Use the mounted training volume, not the system or evidence-storage drive.' }
$aimRelative = 'Users\Alex\Documents\Aster\review-note.txt'
$aimMountedFile = "$aimVolume\$aimRelative"
$aimExport = "$aimCase\exports\review-note.txt"
if (Test-Path -LiteralPath $aimExport) { throw 'Export already exists. Keep it; do not overwrite.' }
$aimFile = Get-Item -LiteralPath $aimMountedFile -ErrorAction Stop
if ($aimFile.PSIsContainer -or $aimFile.Length -eq 0) { throw 'Expected a nonempty training text file.' }
$aimFile | Select-Object FullName, Length, CreationTimeUtc, LastWriteTimeUtc, LastAccessTimeUtc |
    Export-Csv -LiteralPath "$aimCase\notes\source-file-details.csv" -NoTypeInformation
$aimSourceFileHash = Get-FileHash -Algorithm SHA256 -LiteralPath $aimMountedFile -ErrorAction Stop
Copy-Item -LiteralPath $aimMountedFile -Destination $aimExport -ErrorAction Stop
$aimExportHash = Get-FileHash -Algorithm SHA256 -LiteralPath $aimExport -ErrorAction Stop
@($aimSourceFileHash, $aimExportHash) | Export-Csv -LiteralPath "$aimCase\notes\export-sha256.csv" -NoTypeInformation
if ($aimSourceFileHash.Hash -ne $aimExportHash.Hash) { throw 'Export hash differs. Keep the failed check and investigate.' }
@(
    "UTC export: $((Get-Date).ToUniversalTime().ToString('o'))"
    "Image: $aimWorking; mounted volume: $aimVolume"
    "Source within image: $aimRelative; source presented as: $aimMountedFile"
    "Export: $aimExport; bytes: $($aimFile.Length)"
    'Method: file copy from AIM read-only disk-device mount; not carving'
) | Set-Content -LiteralPath "$aimCase\notes\export-record.txt"
Get-Content -LiteralPath $aimExport
@($aimSourceFileHash, $aimExportHash) | Format-Table Path, Hash -AutoSize

Look for: the note's readable contents, two matching file hashes, source-file-details.csv and export-record.txt. Add your mount screenshot, time, mode and complete drive list to the notes folder. The export's hash is a check of that file; it is different from the whole image's hash.

File saved I saved the read only settings, mount time, image path and actual drive letters. I saved the agreed note separately, its source details and matching source/export hashes.Pause point: close files and remove the mount before leaving the workstation. Keep the mount record and repeat the checks if you mount it again.

Next: remove the mount and check the image.

Continue to handover

Activity 3: Remove and hand over¶

Final resultA removed mount, an unchanged working image and notes the next analyst can follow.

1. Remove the image and check its hash

Close Notepad, Explorer and any other application using the mounted drive. In AIM, select the image and choose Remove. Confirm every drive recorded for that mount disappears and AIM no longer lists the image. Save the removal time, messages and a screenshot. If removal fails, close remaining handles and retry; preserve error or forced removal messages rather than calling it a clean removal.

Run this block after removal. It saves the new hashes before comparing them, so a failed check stays in your notes.

$aimBeforeRows = @(Import-Csv -LiteralPath "$aimCase\notes\before-mount-sha256.csv" -ErrorAction Stop)
$aimSavedBefore = @($aimBeforeRows | Where-Object { $_.Path -eq $aimWorking })
$aimSavedOriginal = @($aimBeforeRows | Where-Object { $_.Path -eq $aimOriginal })
if ($aimSavedBefore.Count -ne 1 -or $aimSavedOriginal.Count -ne 1) { throw 'Cannot identify the saved image hashes.' }
$aimAfter = Get-FileHash -Algorithm SHA256 -LiteralPath $aimWorking -ErrorAction Stop
$aimOriginalAfter = Get-FileHash -Algorithm SHA256 -LiteralPath $aimOriginal -ErrorAction Stop
@($aimAfter, $aimOriginalAfter) | Export-Csv -LiteralPath "$aimCase\notes\after-removal-sha256.csv" -NoTypeInformation
if ($aimAfter.Hash -ne $aimSavedBefore[0].Hash -or $aimOriginalAfter.Hash -ne $aimSavedOriginal[0].Hash) {
    throw 'An image changed. Keep all copies and checks; investigate before handing over.'
}
"UTC post-removal check: $((Get-Date).ToUniversalTime().ToString('o'))" |
    Set-Content -LiteralPath "$aimCase\notes\post-removal-check-time.txt"
@($aimAfter, $aimOriginalAfter) | Format-Table Path, Hash -AutoSize

Look for: the working image and original still match their earlier file hashes, plus a saved removal record. Matching hashes do not replace the drive removal check or establish who used the workstation.

2. Write a short handover and keep the case

Create notes\handover.txt. Use these prompts, replacing the brackets with what you actually observed:

Case SUSA-IMG-021
Image source: [supplier or self-created training image; path and size]
Mount: [AIM version; working image; mode; sector size; times; actual drive letters]
Finding: [file found or absent; contents relevant to the task]
Export: [source path within the image; saved path; size; SHA-256 check result]
Removal: [all assigned drives gone; errors or retries; before/after image hash result]
Still unknown: [what the note and these checks cannot tell us]
Next step: [another record or tool to check the missing-project-file report]

For the suggested training note, a reasonable finding is that the file mentions a pending access review. It does not show who deleted files or prove data theft. The next analyst could check the approval log and examine file system records with Autopsy. Record any missing file or failed check plainly; it is a valid result even though that checkpoint cannot be ticked.

Look for: a handover that names the source, separates observations from assumptions, reports limitations and gives a useful next step.

Ready to hand over I recorded removal, confirmed all assigned drives disappeared and saved matching post removal image hashes. I saved a handover with the finding, export details, limitations and next step.Keep the complete case folder and source record before restoring the VM.

Next: review your saved files, then keep them for another analyst.

Review the case files

Your finished case¶

Starting recordImage source and identity, permission, AIM version, workstation/time notes and original/working-copy hashes.
Mount and exportSettings, actual drive letters, mount screenshot/time, agreed file, source details and checked export.
Removal and handoverRemoval record, retained errors/retries, post removal hashes, finding, limitations and next step.

0 of 6 evidence checkpoints marked.

Keep the case before restoring Windows¶

Confirm AIM has no mount remaining. Keep the original image, case folder, exports and notes on storage that survives a VM restore; check that you can still open those saved records. Restore the clean analysis VM snapshot only after retaining them. Reset progress clears this page's ticks, not your image, mount or files.

This exercise covers a small, readable, unencrypted volume. It does not cover image acquisition, encrypted volumes, malware scanning, deleted file recovery or AIM's VM launch features. Continue with Autopsy to examine the missing file lead, or revisit Mount and verify if the mounting checks failed.