Install xmount with Homebrew, apt, dnf

Project links

• Homepage

Commands and aliases

• xmount

Project history

The original project page at pinguin.lu describes the older xmount line, credits Guy Voncken for the idea and bug help, and notes that the project later moved to SITS. The current SITS page is the maintained project home and points to the SITS Git repository and releases.

The SITS README documents a modernized 1.x architecture with external input libraries and morphing libraries. That design lets xmount support forensic formats through libraries such as libewf and AFF/AFF4 implementations while also handling operations such as combining multiple images, RAID0 reconstruction, byte swapping, and extraction of unallocated sectors.

Adoption history

xmount's adoption is forensic-practitioner adoption rather than mass developer adoption. It entered Debian/Ubuntu packaging, which the SITS page explicitly acknowledges, and it appears in security distributions such as Kali because investigators frequently need to bridge evidence-image formats and virtualization tools.

SANS Internet Storm Center coverage captures the practical appeal: xmount is handy when a workflow needs DD, EWF, or AFF input and a format that can be consumed by analysis or virtualization tooling. The SITS page makes the same point with booting acquired images in QEMU, KVM, VirtualBox, or VMware while redirecting writes to a cache file.

How it is used

A typical xmount workflow mounts an acquired disk image read-mostly through FUSE, exposes a virtual output image in the requested format, and then attaches that output to forensic tools or a virtual machine. Virtual write support redirects changes into a cache file so the original evidence image is not modified.

More advanced usage uses morphing: multiple image segments can be combined, RAID0 member disks can be reconstructed, and selected filesystem regions can be presented as a derived virtual image. That makes xmount useful in the awkward middle of a case, where evidence format, analysis tool, and hypervisor all expect different disk-image conventions.

Why package nerds care

xmount is a good example of a package that exists because copying giant images is the wrong abstraction. The package value is not a new archive format; it is the Unix move of presenting a virtual filesystem facade over messy real-world evidence formats.

For package nerds, it also sits at the crossroads of FUSE, forensic image libraries, and VM disk formats. Installing one CLI can remove several slow, lossy, or storage-heavy conversion steps from an incident-response workstation.

Timeline

• Pre-2024: The original pinguin.lu project page documents xmount 0.7-era features such as CMake, multiple input images, image morphing, and internal EWF support.
• 2024-03-13: The current SITS GitLab project is created.
• 2024-2026: The SITS README copyright span and releases document the maintained 1.x line under SITS.
• 2020s: xmount remains packaged in forensic/security-oriented distributions for mounting and converting evidence disk images through FUSE.

Related projects

• Guymager is the forensic acquisition tool credited by xmount's project pages and linked from the acknowledgments.
• libewf and afflib provide support for common forensic evidence image formats used by xmount.
• FUSE is the user-space filesystem layer that lets xmount present virtual converted disk images without writing a full output copy.
• QEMU, KVM, VirtualBox, and VMware are common consumers of xmount's virtual output images.

Sources

• https://code.sits.lu/foss/xmount
• https://code.sits.lu/foss/xmount/-/raw/1.3.1/README
• https://isc.sans.edu/diary/28002
• https://pinguin.lu/xmount
• https://www.kali.org/tools/xmount/
• https://www.sits.lu/xmount