xmount
Tool to crossmount between multiple input and output harddisk image files
root@kali:~# xmount -h
xmount v1.2.1 Copyright (c) 2024-2025 by SITS Sarl <development@sits.lu>
Usage:
xmount [fopts] <xopts> <mntp>
Options:
fopts:
-d : Enable FUSE's and xmount's debug mode.
-h : Display this help message.
-s : Run single threaded.
-o no_allow_other : Disable automatic addition of FUSE's allow_other option.
-o <fopts> : Specify fuse mount options. Will also disable automatic addition of FUSE's allow_other option!
xopts:
--cache <cfile> : Enable virtual write support.
<cfile> specifies the cache file to use.
--in <itype> <ifile> : Input image format and source file(s). May be specified multiple times.
<itype> can be "qcow", "qcow2", "qemu", "aff", "aff3", "raw", "dd", "aaff", "vdi", "aewf", "ewf".
<ifile> specifies the source file. If your image is split into multiple files, you have to specify them all!
--inopts <iopts> : Specify input library specific options.
<iopts> specifies a comma separated list of key=value options. See below for details.
--info : Print out infos about used compiler and libraries.
--morph <mtype> : Morphing function to apply to input image(s). If not specified, defaults to "combine".
<mtype> can be "unallocated", "raid0", "combine".
--morphopts <mopts> : Specify morphing library specific options.
<mopts> specifies a comma separated list of key=value options. See below for details.
--offset <off> : Move the output image data start <off> bytes into the input image(s).
--out <otype> : Output image format. If not specified, defaults to "raw".
<otype> can be "raw", "dmg", "vdi", "vhd", "vmdk", "vmdks".
--owcache <file> : Same as --cache <file> but overwrites existing cache file.
--rocache <file> : Same as --cache <file> but does **not** allow further writes.
--sizelimit <size> : The data end of input image(s) is set to no more than <size> bytes after the data start.
--version : Same as --info.
mntp:
Mount point where output image should be located.
Infos:
* One --in option and a mount point are mandatory!
* If you specify --in multiple times, data from all images is morphed into one output image using the specified morphing function.
* For VMDK emulation, you have to uncomment "user_allow_other" in /etc/fuse.conf or run xmount as root.
Input / Morphing library specific options:
Input / Morphing libraries might support an own set of options to configure / tune their behaviour.
Libraries supporting this feature (if any) and their options are listed below.
- libxmount_input_aaff.so
aaffmaxmem : Maximum amount of RAM cache, in MiB, for image seek offsets. Default: 10 MiB
aafflog : Log file name.
Specify full path for aafflog. The given file name is extended by _<pid>.
The AFF format has been declared as deprecated by its inventor!
- libxmount_input_vdi.so
vdilog : Path for writing log file(must exist).
The files created in this directory will be named log_<pid>.
- libxmount_input_aewf.so
aewfmaxmem : Maximum amount of RAM cache, in MiB, for image offset tables. Default: 10 MiB
aewfmaxfiles : Maximum number of concurrently opened image segment files. Default: 10
aewfstats : Output statistics at regular intervals to this directory (must exist).
The files created in this directory will be named stats_<pid>.
aewfrefresh : The update interval, in seconds, for the statistics (aewfstats must be set). Default: 10s.
aewflog : Path for writing log file (must exist).
The files created in this directory will be named log_<pid>.
aewfthreads : Max. number of threads for parallelized decompression. Default: System CPUs (6)
A value of 1 switches back to old, single-threaded legacy functions.
- libxmount_morphing_unallocated.so
unallocated_fs : Specify the filesystem to extract unallocated blocks from. Supported filesystems are: 'hfs', 'fat'. Default: autodetect.
- libxmount_morphing_raid.so
raid_chunksize : Specify the chunk size to use in bytes. Defaults to 524288 (512k).