1

I'm doing a forensic analysis of a hard drive that I have imaged to a dd image. The image is a NTFS filesystem that I mount in my Windows system with FTK Imager in read-only mode.

Then, I search in the mounted drive for a file but in the search appear files inside directories of my system. In the mounted drive D: there are links to my C: drive, for example, in D:\Users\All Users appear my users too!

How can I disable temporarily these links in order to perform the forensic analysis of the NTFS filesystem?

kinunt
  • 2,759
  • 2
  • 23
  • 30
  • You could mount your HDD to be another letter than C: and mount the virtual disk as C: then links would be all correct. – Paul Jun 16 '14 at 11:56

1 Answers1

1

Windows naturally tries to deference NTFS junction points, much like Linux automatically dereferences mount points and symlinks. You can't get around this directly in the Windows OS, as Windows needs junction points to operate correctly, except possibly when using an alternate shell in Safe Mode, although this would probably have some interesting side effects while logged in. The only way to "disable" a NTFS junction is to delete it entirely, not something you could do in read-only mode.

What you can do, however, is not use Windows directly. For example, boot your system in Linux, possibly using a cheap USB stick and a Linux-on-a-stick, and you can mount the image directly into Linux, and perform all the find operations you want without worrying about it wandering into your hard drive, since your drive won't be mounted, and Linux has no notion of drive letters anyways. Your mileage may vary here, as NTFS support, while quite excellent, is not quite as good as Windows' own NTFS support. Personally, I would just as soon whip out a copy of Ubuntu USB version, boot it, mount the image, and go exploring.

Another excellent alternative would be to simply mount the drive in a VM running Windows. You probably qualify for Windows XP Mode if you're using almost any modern version of Windows. Install, mount the drive, and examine to your heart's content. Since you're in a VM, any damage done to the drive will only harm the VM, and not your computer. You can reinstall it as many times as you need, and as long as you've backed up that hard drive image, you can "reformat" back to that image as often as you desire. At that point, you could recklessly experiment with deleting those junction points, assigning a new letter to your boot drive, etc.

phyrfox
  • 5,724
  • 20
  • 24