Mounting Split Raw Images A raw image, made with dd or a variant, is still a common image format, and will not go away soon even as many argue the benefits of forensic images such as the Expert Witness Format (supplied through libewf) and the Advanced Forensic Format (supplied through afflib). But raw images can be difficult to tote around because they are bit for bit copies which makes the copy as large as the original. As such, the images are often split to fit on external media such as DVD. But splitting, while solving storage problems, creates a new problem. What if you want to mount the image for examination? True, Sleuthkit can handle the examination of split raw images, but sometimes there is no equal to simply mounting an image during an examination. Let me illustrate using a situation I encountered yesterday. A colleague had a split raw image of over 200 segments that he wished to mount and then boot in a virtual machine. He tried to follow m...