Cults14,
I have successfully mounted, "suppressed"/unlocked Bitlocker encrypted images and accessed file contents using Mount Image Pro v. 5.28 (1156) that could not be accessed using FTK Imager Lite.
I believe Mount Image Pro runs about $500 per license, but it has proven invaluable in many cases where FTK Imager Lite was not able to fully "mount" a forensic image (DD or otherwise).
For some reason, forensic images mounted by Mount Image Pro are more "robust" or complete than forensic images mounted by FTK Imager Lite. I do not have a quantitative explanation of the differences in mounted images between the two, but am guessing that Mount Image Pro perhaps more completely simulates an actual physical hard drive, thus allowing Bitlocker encryption to be suppressed or turned off.
I am able to use FTK Imager Lite mounted images in conjunction with OSForensics' excellent tool just fine assuming there is no Bitlocker encryption in place.
Regards -
↧