How do I mount the contents of an ewf?

[nabsers1]

I am attempting to mount the ewf1 output of my e01 that I acquired by running

sudo ewfmount test.E01 /mnt/ewf/

I run sudo mount /mnt/ewf/ewf1 -o ro,norecovery /mnt/fmount

and i get the output: mount: /mnt/fmount: cannot mount /mnt/ewf/ewf1 read-only.

This is what I am trying to mount: `Model: (file) Disk /mnt/ewf/ewf1: 1074MB Sector size (logical/physical): 512B/512B Partition Table: loop Disk Flags:

Number Start End Size File system Flags 1 0.00B 1074MB 1074MB ntfs `

This is for a school project, does anyone have any ideas, thank you in advance!

[joachimmetz]

Make sure fuse is configured to allow mount as root or pass -X allow_root. If you're trying to mount the file system at a specific offset make sure to pass the offset, see man mount.

[nabsers1]

Thank you sir this worked. I don't suppose you know if I could mount E01s in a way that I can modify the contents of the filesystem once mounted, passing the -w flag into the mount command just returns an error and the mount continues in read only mode, I appreciate the help.

[joachimmetz]

have a look at xmount

[nabsers1]

Thank you, I have now implemented xmount. It looks like xmount allows virtual write access via the use of a VM, would you happen to know of a way to do this without incorporating VMs for more simplicity if possible?

[joachimmetz]

VM? doesn't it support a write cache/shadow file ?

[nabsers1]

I seem to be able to create a vdi file with it, which is why I think it is writable by opening in a VM, not sure how to make the shadow/cache file though.

[joachimmetz]

not sure how to make the shadow/cache file though.

should be one of the options