 Welcome back, everyone. I was asked to have to mount a physical disk from a raw disk image. And I have here a raw disk image, image with Gaimager. It's just USB sticks, so it's quite small, but it does have two parts, this LG 0 0 0 and LG 0 0 1. There are two parts to this. And they're just, yeah, raw disk images directly copied from the USB disk. So we're going to mount this disk image. So if we go to in a FTK imager, let me just close this here in FTK imager from access data, open it as administrator and then go to file and image mounting file image mounting. And then choose the image file. I just put this on the desktop and I need to choose the first part of the image in the first part of this image is 0 0 0. So choose LG 0 0 0. Click open. And then in my case, this I know that this disk image has is is a physical disk image, but it also has a logical partition. So if I just want to do only a physical disk, I can do physical only or logical only. In this case, well, in the case of the person who requested this, they wanted physical only and they wanted to mount all of the images separately and rebuild arrayed array. It'll work exactly the same way basically. So this will just mount the disk images, but it won't rebuild your array without some software assuming that the raid was created using a software radar array. I'm just going to choose physical and logical right now just to show you how it works for mine. Again, this is just is just a USB stick. There's no raid on here. So next available the drive letter that I want it mounted as I'm going to choose Z because I have some some drives already and then click mount. And then we can see it's mounted as physical drive one physical drive zero is the C drive in my is the main disk, which is basically the C partition on my computer physical drive one is how the image is mounted and it's using LG zero zero zero and it's mounted the partition was automatically detected at this location and it was mounted at Z drive. Okay, so now I can close that. Actually, I didn't need to close a bit of well. And then I can go to if I scroll all the way down, I should find Z drive. So I can see my Z drive there which has the same label as my my disk. And then this is all of the files that were basically in that Z drive. Whenever I was there. So now I have full access to the mounted raw disk image, even though, yeah, I have full access to the mounted raw disk image. If windows could not understand the file system. So I believe the file system on this was probably fat 32. So we can check that if windows didn't understand the file system. Yeah, it was fat 32. If it didn't understand the file system, if it was fat formatted with some maybe a Linux file system or something like that, then it would not automatically mount it because windows wouldn't understand it, right? In the case of a raid array. Right now we have this, you see that it mounted the physical drive and the logical drive. So basically, if we unmount the logical drive, we just have this physical drive one here. Okay, now, if you have multiple disk images, multiple physical disk images from a software raid array, then you can mount, you can try to mount all of the physical disk images as a physical drive, and then go into your raid management software, and try to rebuild the array. Okay, that's, it's a way to do it. Rebuilding arrays in forensics is a bit difficult. If it was a hardware array, you're going to have a lot of problems because you have to try to emulate the hardware. But if it was a software array, and you know the software that was used, you might be able to. Now, most likely, if it was a software array, you either have the Microsoft, the Windows software that was doing the, the doing the raid, or if it was on Linux, you can find out what the software was. But if it was on Linux, I would recommend using Linux to try to rebuild the array. Okay, so try to use the same operating system as the original system. Okay, so that's basically how to mount a physical and logical disk image, a raw disk image, and let's say, multi part raw disk image in Windows using FTK imager, you can just mount physical disk, physical drives, and then try to rebuild whatever types of arrays you might have had from there. So that's it for today. Thank you very much. If you liked this video, please subscribe for more.