E01/EWF 取证镜像只读挂载

专门处理 Expert Witness Format 的 E01/EWF 磁盘镜像。它使用 libewf 的 ewfmount 以 FUSE 方式只读打开单段或多段 E01/E02 镜像，在证据目录中生成 ewf1 原始磁盘视图，并给出挂载前验证、挂载确认、卸载以及 FUSE 权限异常的处理方法。Skill 特别强调 ewfmount 应由普通用户执行，避免生成 root 独占的 ewf1，从而保证 mmls、The Sleuth Kit、Plaso 等后续取证工具可以继续读取；需要解析文件系统分区时可衔接 NTFS 只读挂载流程。

在 AI 中使用此 Skill将本页链接复制给 AI，即可让 AI 获取完整 Skill 内容并按此执行

安全提示： 本站 Skill 均经 ChatGPT 最新模型扫描，未发现恶意脚本及危险指令、未检出已知恶意行为特征，但不保证绝对安全，使用即表示接受此风险

Skill 文件

版本 20260601 · a2b570f638b54cb8df7d936d36722a95

references/

skills/

tools-mount-ntfs/

SKILL.md

---
name: tools-mount-e01
description: Mount EWF/E01 forensic images read-only with ewfmount and expose the raw ewf1 device for downstream filesystem analysis.
---


## XingLo Standalone Package Notes

The downstream NTFS partition-mount procedure referenced after `ewfmount` is bundled under `references/skills/tools-mount-ntfs/guide.md`, so the E01 workflow can continue without a separately installed sibling Skill.

# Skill: tools-mount-e01 — Mount EWF/E01 Disk Images

## Overview

Mounts an Expert Witness Format (EWF / E01) disk image read-only using `ewfmount` (FUSE).
The FUSE mount exposes a raw disk file (`ewf1`) that is then loop-mounted by `/tools-mount-ntfs`.

**Tool:** `ewfmount` (system PATH) — part of libewf

---

## Case Path Convention

| Path | Purpose |
|------|---------|
| `./sources/<asset_id>/<image>.E01` | Evidence file (read-only, never modified) |
| `./sources/<asset_id>/e01-<imgbase>/` | FUSE mount point — created at mount time, named from the image (`base-dc-cdrive.E01` → `e01-base-dc-cdrive`) |
| `./sources/<asset_id>/e01-<imgbase>/ewf1` | Raw disk exposed by ewfmount |

---

## Commands

### Verify image before mounting
```bash
ewfverify ./sources/<asset_id>/<image>.E01
ewfinfo  ./sources/<asset_id>/<image>.E01
```

### Mount
```bash
ASSET="<asset_id>"
SRC="./sources/$ASSET"
IMG="base-dc-cdrive"          # the image filename stem (your .E01 minus its extension)

mkdir -p "$SRC/e01-$IMG"
ewfmount "$SRC/$IMG.E01" "$SRC/e01-$IMG/"   # NO sudo — keep ewf1 user-owned and readable

# Confirm
ls -lh "$SRC/e01-$IMG/ewf1"
```

### Multi-segment images (E01, E02, … or .e01, .e02, …)
`ewfmount` automatically discovers all segments when given the first file.
```bash
ewfmount "$SRC/$IMG.E01" "$SRC/e01-$IMG/"   # NO sudo
```

### Unmount
```bash
fusermount -u "$SRC/e01-$IMG/" 2>/dev/null || sudo umount "$SRC/e01-$IMG/"
rmdir "$SRC/e01-$IMG/"
```

---

## Troubleshooting

| Symptom | Fix |
|---------|-----|
| `ewfmount: unable to open EWF file(s)` | Check file path; verify all segments present |
| `Transport endpoint is not connected` | Mount point stale — fusermount -u first, then re-mount |
| `fuse: failed to open /dev/fuse` | Add the user to the `fuse` group (`sudo usermod -aG fuse $USER`); do NOT sudo ewfmount — that makes `ewf1` root-owned and unreadable to the analysis tools |
| Slow mount on large images | Normal for ewfmount; verify with `ls ewf1` after a few seconds |

---

## Notes

- `ewfmount` is read-only by design — it cannot write to the evidence file.
- Run `ewfmount` **as the user, never sudo**. A root-owned `ewf1` is unreadable to the analysis
  tools; only the later `mount -o loop` (in `/tools-mount`) needs root.
- The `ewf1` file is a virtual raw image; pass it to `mmls`, `mount`, or `log2timeline.py`.
- Do not use `xmount` as a substitute — it does not support multi-segment EWF on all SIFT builds.