search

ArsenalRecon / Arsenal-Image-Mounter

Arsenal Image Mounter mounts the contents of disk images as complete disks in Microsoft Windows.
https://ArsenalRecon.com/weapons/image-mounter
Other
496 stars 85 forks source link

phdskmnt.sys bsod #10

Closed jonathancassar closed 3 years ago

jonathancassar commented 5 years ago

when browsing through mounted image (bitlockered) windows 10 gives bluescreen caused by phdskmnt.sys IRQ not less then or equal.

cshanahan commented 4 years ago

I am getting the same error and system crash (BSOD) using latest AIM on a Windows 10 system with Xeon CPU. I am attempting to mount and interact with an EWF (E01) image of a Windows 7 system. BitLocker is not involved.

phdskmnt.sys IRQ not less then or equal

Any workaround or fix for this yet?

Thanks.

/cms

LTRData commented 4 years ago

We very rarely get reports about bsods with this drivers nowadays, but there might of course be some problem somewhere that we should try to fix. Would it be possible for you to share a dump file (minidump) from the crash so that we could try to analyze what happened?

davepo commented 4 years ago

I just experienced this with the aim_cli driver running on Windows 10 64 bit. Images were mounting fine every time, but after about 15 minutes into an AV scan it would BSOD on phdskmnt.sys.
I eventually got it to work after some trial and error troubleshooting. I noticed there were two entries in Device Manager for the Storage controllers > Arsenal Image Mounter. I disabled one, tried again, and had no issues. I don't know if there are supposed to be two entries or why that would have helped, but it's the only thing I changed. I don't have a second system to test it on right now, so it is possible there was just something finicky with this one.

LTRData commented 4 years ago

Thanks for your report. There have been versions of AIM where the .inf file used for driver setup has caused two controllers to appear in Device Manager (although only one of them are actually initialized and used internally by the driver). We have not seen any problems related to that before as far as I know, though. Anyway, current and upcoming versions have another .inf file that no longer results in two controllers.