We're building a new CTF (Capture the Flag) disk image incorporating technologies (e.g. Windows on Arm) & configurations not seen before in publicly-accessible disk images. Are there applications or configurations important to your casework that you would like us to add? #DFIR

Our latest in-person training “Windows Arm-on-Arm (WoA) Virtualization for Digital Forensics Practitioners” debuted last week, covering why we launch VMs from disk images (& actual & remotely-connected disks), peculiarities w/ WoA vs. x64, WinFE, BitLocker, S Mode, & more. #DFIR

"My client was stunned that he could see how the document looked over time just as the user had seen it, & asked if this was voodoo forensics! Leveraging VSCs launched into virtual machines was crucial to this matter & very jury friendly." See more: arsenalrecon.com/testimonials. #DFIR

In case you missed it last week, a new Arsenal Image Mounter (v3.12.331) has been released with a long list of improvements for #DFIR practitioners including Arm on Arm virtualization. You can see some highlights in our Insights article at arsenalrecon.com/insights/qui....

Check out this awesome testimonial regarding launching Windows Volume Shadow Copies (VSCs) into virtual machines with AIM! Have you tried this in your own #DFIR casework yet? arsenalrecon.com

Are you a #DFIR practitioner in the New England area? Want to see Arsenal Image Mounter’s new functionality in person? Contact us & let’s set something up soon so you can see Arm on Arm virtualization, AIM Remote Agent enhancements, & more! arsenalrecon.com

Do you have a digital forensics workstation running Windows on Arm (WoA) in your lab yet? We have some thoughts about this towards the end of our latest Insights article at arsenalrecon.com/insights/qui.... Let’s discuss! #DFIR

Check out our latest Insights article "Quick Tour Of New Features In Arsenal Image Mounter v3.12.331" to see highlights (lots of screenshots!) of the latest AIM functionality: arsenalrecon.com/insights/qui.... #DFIR

Did you know that AIM Remote Agent can be run from SUMURI's PALADIN? See Anastasia boot a Surface Pro 5 w/ two 512gb drives, connect both drives to AIM across a network (w/ automatic Storage Spaces reassembly), & launch a virtual machine. arsenalrecon.com #DFIR

Did you know that Arsenal Image Mounter running on Windows on Arm (WoA) can launch virtual machines across a network from WoA laptops & tablets (booted in a forensically-sound manner, e.g. w/ WinFE or PALADIN) thanks to AIM Remote Agent? See it now! arsenalrecon.com #DFIR

Do you know how many Arm-based laptops & tablets (other than those from Apple) are in your custody? Would you like an infographic to help identify them in the field & in your evidence room? Check out this article from Windows Central in the meantime: www.windowscentral.com/hardware/lap... #DFIR

Keep in mind, AIM Remote Agent also runs on Windows on Arm… so in addition to attaching WoA disk images & actual physical disks to AIM locally, WoA disks can be connected to AIM across a network when their hosts are booted safely with (e.g.) WinFE! #DFIR

Are you a #DFIR practitioner? Take some time to focus on this screenshot. Windows on Arm laptops & tablets aren’t just coming, they’re here. The new Arsenal Image Mounter runs on WoA & seamlessly launches WoA disk images (& disks!) into virtual machines. arsenalrecon.com

We know ICAC Task Forces (www.icactaskforce.org) encounter Arm-based computers often & will leverage Arsenal Image Mounter’s new Arm functionality in very important ways. As a reminder, we provide a free Arsenal license to every ICAC Task Force. arsenalrecon.com #DFIR

See the new Arsenal Image Mounter on a Samsung Galaxy Book Go (Snapdragon 7c Gen 2 CPU & only 4gb RAM!) launch a disk image from a Dell Inspiron 14 3420 (Snapdragon 8cx Gen 2, 8gb RAM) running Windows on Arm in S Mode into a virtual machine. Awesome. arsenalrecon.com #DFIR

Each Arsenal license purchased this week will come with a free seat of AIM Online Training (including one certification attempt) as we celebrate the release of the latest AIM yesterday. arsenalrecon.com #DFIR

Look closely at Arsenal Image Mounter running on Arm-based laptops & tablets from Microsoft, Dell, & Samsung with Snapdragon X Plus, X Elite, 8cx Gen 2, & 7c Gen 2 CPUs launching virtual machines from other Arm-based computers. Months of R&D now paying off for AIM users! #DFIR

Do you have a #DFIR workstation running Windows on Arm? If you don’t now, you may soon after checking out Arsenal Image Mounter’s new Arm on Arm virtualization. While waiting on the Snapdragon X2 Elite, we're using a Dell XPS 13 (X Elite) with 64gb RAM. arsenalrecon.com

Arsenal Image Mounter's new Arm on Arm virtualization is powerful, unique, & a big deal for #DFIR practitioners. If you have Windows on Arm computers (or disk images) in your evidence room, time to get them out! What do you see in these screenshots? arsenalrecon.com #DFIR

Arsenal Image Mounter v3.12.331 just released w/ Arm on Arm virtualization, Windows S Mode bypass (x64 & Arm!), multiple simultaneous disk connections w/ AIM Remote Agent, BitLocker support extended to Windows File System Driver Bypass Mode, & more. arsenalrecon.com #DFIR

A major new build of Arsenal Image Mounter is just around the corner! Check out this brief teaser demonstration of forensically-sound Arm on Arm virtualization over a network. An enormous amount of effort over the summer went into making this happen. arsenalrecon.com #DFIR vimeo.com/1126823800

One of our favorite places to provide unique & in-person only digital forensics training is Microsoft. Beautiful classrooms, coffee bars always nearby, & a quick walk for Xbox R&R between classes. (Some computing history too!) #DFIR

We've been quiet on social media this summer... when this happens, we tend to be focused on adding unique & powerful functionality to our digital forensics tools & high-stakes casework. Can you identify one of our summer priorities for Arsenal Image Mounter from this image? #DFIR

Fellow #DFIR practitioners - what do you see happening in this short video involving WinFE, AIM Remote Agent, & Arsenal Image Mounter? arsenalrecon.com

How do you connect AIM Remote Agent over a network to Arsenal Image Mounter on your forensic workstation when automatic discovery does not work (perhaps due to network filtering)? It's very easy - just use an IP address. See us demonstrate in this short video. #DFIR

Did you know that after booting a computer w/ WinFE, you can use AIM Remote Agent to connect it over a network to Arsenal Image Mounter on your forensic workstation w/ the same functionality as if the remote disk was a disk image or local physical disk? E.g. mounting VSCs! #DFIR

Headed back to the office after a few days at the Wisconsin ICAC conference where we provided training to digital forensics practitioners doing incredibly important work. We also learned more about how ESD (Electronic Storage Detection) K-9s are used & saw them in action. #DFIR

We're teaching & exhibiting at the Wisconsin ICAC (Internet Crimes Against Children) conference this week. Come see us & make a copy of our Password Sledgehammer database w/ >23 billion unique password hashes for use when launching virtual machines w/ Arsenal Image Mounter. #DFIR

Watch Emina & Anastasia attach a disk image, an actual physical disk, & a remote disk to Arsenal Image Mounter & then launch each of them into a virtual machine with some of AIM's extremely powerful & unique functionality! vimeo.com/1079363782 #DFIR

Arsenal Image Mounter v3.11.307 is now available with minor fixes & other improvements which include improved handling of corrupt Registry hives when launching virtual machines. See the change log for more information. arsenalrecon.com/downloads #DFIR

Three years ago a law enforcement CTF team asked us about a disk image they were told was neutered & could not be launched into a virtual machine. Arsenal Image Mounter launched it into a VM fine & provided access to all the "suspect’s" secrets w/o Windows credentials. How? #DFIR

Attending the National Cyber Crime Conference in Boston next week? Come see our presentations & chat at our booth! You can see “Disk Images are Gamblers and Virtualization is Vegas” on 4/30 11:30am, 5/1 10am, & 5/1 3:50pm. www.mass.gov/info-details... #NCCC2025 #DFIR

After connecting Arsenal Image Mounter to a remote disk over a network (w/ AIM Remote Agent) you may want to obtain a disk image. Emina & Anastasia use AIM itself to obtain a disk image in this video, but you could use any disk imaging tool you like! arsenalrecon.com #DFIR

Did you know you can attach not only disk images, but actual physical disks & remote disks to Arsenal Image Mounter? Then leverage all of AIM's powerful & unique functionality against them - launching VMs, mounting VSCs using multiple methods, etc. arsenalrecon.com #DFIR

We've shown how easy it is to connect disks to Arsenal Image Mounter over a network with AIM Remote Agent, now watch Emina & Anastasia launch remotely-connected disks into virtual machines! Notice the combination of reliable, powerful, & unique here? vimeo.com/1077264833 arsenalrecon.com #DFIR

How easy is it to boot computers with WinFE (Windows Forensic Environment) & use the new AIM Remote Agent to connect their disks to Arsenal Image Mounter over a network? Very easy - watch Emina & Anastasia do it! Then, imagine the possibilities... arsenalrecon.com #DFIR

Have you seen the new AIM Remote Agent in action yet? Come see us April 29-May 1 at the 2025 National Cyber Crime Conference hosted by the MA Attorney General's Office or the Wisconsin ICAC Conference May 6-8... bring your laptop for some hands on! arsenalrecon.com #DFIR

Arsenal Image Mounter v3.11.306 is now available with minor fixes & other improvements. See the change log for more detail. arsenalrecon.com/downloads #DFIR

Check out Emina doing some electronic evidence triage - booting a computer with WinFE, using AIM Remote Agent to connect it over a network to Arsenal Image Mounter on a forensic workstation, & finally running a Recon Report. arsenalrecon.com #DFIR

Just received a great testimonial re: Arsenal Image Mounter from Australian law enforcement. The #DFIR community suggested they try AIM after having trouble launching forensic images into virtual machines with another tool... & now they are having success. arsenalrecon.com

Did you know that Arsenal Image Mounter's Free Mode includes archive mounting as drive letters? arsenalrecon.com #DFIR

Volume Shadow Copies (VSCs) from two remote disks mounted by Arsenal Image Mounter in a forensically-sound manner thanks to WinFE (Windows Forensic Environment) & AIM Remote Agent. arsenalrecon.com #DFIR

Check out two remote disks launched into virtual machines by Arsenal Image Mounter after an ASUS laptop & TALINO workstation were booted with WinFE & their disks made available by AIM Remote Agent over a network. arsenalrecon.com #DFIR

Check out our latest Insights article "Introducing AIM Remote Agent" for some compelling use cases, screenshots, & photos involving computers booted with WinFE (Windows Forensic Environment) & disks shared over networks with Arsenal Image Mounter. arsenalrecon.com/insights/int.... #DFIR

Unlocking a remote disk's BitLocker-protected volume & then selecting virtual machine launch options, thanks to WinFE booting a laptop & AIM Remote Agent making its disk accessible to Arsenal Image Mounter over a network. arsenalrecon.com #DFIR

Emina & Anastasia have been working on a nice series of AIM Remote Agent & WinFE screenshots & photos. Let's start w/ the initial connection of an agent to Arsenal Image Mounter (in this case, the second agent) & then viewing the remote disk details. arsenalrecon.com #DFIR

Launching the "Compromised Windows Server 2022 (simulation)" disk image on CFReDS (cfreds.nist.gov/all/Benjamin...) into a virtual machine with Arsenal Image Mounter. This server is in a strange state, download & check it out for yourself! arsenalrecon.com #DFIR

Bloomsburg University released another interesting CTF disk image this year during BloomCON 0x09. Here are some screenshots of Arsenal Image Mounter launching it into a virtual machine. Good hunting! arsenalrecon.com #DFIR

Have you thought about how the new AIM Remote Agent could assist in your digital forensics workflow? Check out these use cases involving Windows Forensic Environment (WinFE). arsenalrecon.com #DFIR

Check out the entire thread, now with small, but safe, steps to consider. #DFIR