Arsenal Image Mounter
Launching virtual machines directly from disk images, physical disks, and Volume Shadow Copies
Handling BitLocker-protected evidence, including identification, unlock, decryption, and export of decrypted images
Examiners who need Windows authentication, DPAPI, Linux password, or S Mode bypass workflows inside launched VMs
Triage workflows that benefit from Recon Reports, VSC access, and file-system-driver-bypass modes
Labs that need to connect to remote disks over a network with AIM Remote Agent
Browser-based evidence sharing or stakeholder review workflows
Dedicated mobile-device extraction or phone-unlocking workflows
Teams looking for a free-only solution with all advanced functionality included
Labs that mainly need artifact parsing from cloud accounts rather than disk- and volume-centric workflows
Arsenal Image Mounter is a digital forensics platform designed to mount disk images as complete "real" disks in Windows instead of limiting the examiner to shares or partitions. That difference matters because it unlocks workflows that depend on Windows treating the evidence like an actual disk.
Arsenal positions AIM as a flagship product with both Free Mode and Professional Mode capabilities. Free Mode already covers a lot, including mounting raw, forensic, and virtual machine images as complete disks, temporary write support with replayable differencing files, BitLocker identification and decryption support, virtual dd exposure, RAM disk creation, archive mounting, and CLI or PowerShell control.
Professional Mode is where AIM becomes far more powerful. Arsenal highlights direct virtual machine launch from disk images, physical disks, and Volume Shadow Copies; Windows authentication, DPAPI, Linux password, and S Mode bypasses inside launched VMs; file-system-driver-bypass modes; decrypted BitLocker image export; Recon Reports; and remote-disk workflows through AIM Remote Agent.
AIM is strongest when the investigation is disk- and volume-centric and the examiner wants more than passive mounting. It is not just an image mounter. Its value is in making evidence behave in ways that support triage, access, decryption, and VM-based review that many simpler mounting tools cannot do.