iiinova — where your digital self keeps evolving

Arsenal Recon @arsenalrecon.bsky.social · 10/12/2025

We're building a new CTF (Capture the Flag) disk image incorporating technologies (e.g. Windows on Arm) & configurations not seen before in publicly-accessible disk images. Are there applications or configurations important to your casework that you would like us to add? #DFIR

011

Arsenal Recon @arsenalrecon.bsky.social · 09/12/2025

Our latest in-person training “Windows Arm-on-Arm (WoA) Virtualization for Digital Forensics Practitioners” debuted last week, covering why we launch VMs from disk images (& actual & remotely-connected disks), peculiarities w/ WoA vs. x64, WinFE, BitLocker, S Mode, & more. #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 06/11/2025

"My client was stunned that he could see how the document looked over time just as the user had seen it, & asked if this was voodoo forensics! Leveraging VSCs launched into virtual machines was crucial to this matter & very jury friendly." See more: arsenalrecon.com/testimonials. #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 05/11/2025

In case you missed it last week, a new Arsenal Image Mounter (v3.12.331) has been released with a long list of improvements for #DFIR practitioners including Arm on Arm virtualization. You can see some highlights in our Insights article at arsenalrecon.com/insights/qui....

011

Arsenal Recon @arsenalrecon.bsky.social · 05/11/2025

Check out this awesome testimonial regarding launching Windows Volume Shadow Copies (VSCs) into virtual machines with AIM! Have you tried this in your own #DFIR casework yet? arsenalrecon.com

010

Arsenal Recon @arsenalrecon.bsky.social · 03/11/2025

Are you a #DFIR practitioner in the New England area? Want to see Arsenal Image Mounter’s new functionality in person? Contact us & let’s set something up soon so you can see Arm on Arm virtualization, AIM Remote Agent enhancements, & more! arsenalrecon.com

011

Arsenal Recon @arsenalrecon.bsky.social · 02/11/2025

Do you have a digital forensics workstation running Windows on Arm (WoA) in your lab yet? We have some thoughts about this towards the end of our latest Insights article at arsenalrecon.com/insights/qui.... Let’s discuss! #DFIR

111

Arsenal Recon @arsenalrecon.bsky.social · 01/11/2025

Check out our latest Insights article "Quick Tour Of New Features In Arsenal Image Mounter v3.12.331" to see highlights (lots of screenshots!) of the latest AIM functionality: arsenalrecon.com/insights/qui.... #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 31/10/2025

Did you know that AIM Remote Agent can be run from SUMURI's PALADIN? See Anastasia boot a Surface Pro 5 w/ two 512gb drives, connect both drives to AIM across a network (w/ automatic Storage Spaces reassembly), & launch a virtual machine. arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 30/10/2025

Did you know that Arsenal Image Mounter running on Windows on Arm (WoA) can launch virtual machines across a network from WoA laptops & tablets (booted in a forensically-sound manner, e.g. w/ WinFE or PALADIN) thanks to AIM Remote Agent? See it now! arsenalrecon.com #DFIR

010

Arsenal Recon @arsenalrecon.bsky.social · 29/10/2025

Do you know how many Arm-based laptops & tablets (other than those from Apple) are in your custody? Would you like an infographic to help identify them in the field & in your evidence room? Check out this article from Windows Central in the meantime: www.windowscentral.com/hardware/lap... #DFIR

windowscentral.com

Best Windows on ARM laptops in 2025

Want a new Windows laptop? You should consider one powered by an Arm processor. This is our roundup of the best Windows on Arm laptops on the market right now.

000

Arsenal Recon @arsenalrecon.bsky.social · 29/10/2025

Keep in mind, AIM Remote Agent also runs on Windows on Arm… so in addition to attaching WoA disk images & actual physical disks to AIM locally, WoA disks can be connected to AIM across a network when their hosts are booted safely with (e.g.) WinFE! #DFIR

011

Arsenal Recon @arsenalrecon.bsky.social · 29/10/2025

Are you a #DFIR practitioner? Take some time to focus on this screenshot. Windows on Arm laptops & tablets aren’t just coming, they’re here. The new Arsenal Image Mounter runs on WoA & seamlessly launches WoA disk images (& disks!) into virtual machines. arsenalrecon.com

000

Arsenal Recon @arsenalrecon.bsky.social · 28/10/2025

We know ICAC Task Forces (www.icactaskforce.org) encounter Arm-based computers often & will leverage Arsenal Image Mounter’s new Arm functionality in very important ways. As a reminder, we provide a free Arsenal license to every ICAC Task Force. arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 28/10/2025

See the new Arsenal Image Mounter on a Samsung Galaxy Book Go (Snapdragon 7c Gen 2 CPU & only 4gb RAM!) launch a disk image from a Dell Inspiron 14 3420 (Snapdragon 8cx Gen 2, 8gb RAM) running Windows on Arm in S Mode into a virtual machine. Awesome. arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 28/10/2025

Each Arsenal license purchased this week will come with a free seat of AIM Online Training (including one certification attempt) as we celebrate the release of the latest AIM yesterday. arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 28/10/2025

Look closely at Arsenal Image Mounter running on Arm-based laptops & tablets from Microsoft, Dell, & Samsung with Snapdragon X Plus, X Elite, 8cx Gen 2, & 7c Gen 2 CPUs launching virtual machines from other Arm-based computers. Months of R&D now paying off for AIM users! #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 27/10/2025

Do you have a #DFIR workstation running Windows on Arm? If you don’t now, you may soon after checking out Arsenal Image Mounter’s new Arm on Arm virtualization. While waiting on the Snapdragon X2 Elite, we're using a Dell XPS 13 (X Elite) with 64gb RAM. arsenalrecon.com

000

Arsenal Recon @arsenalrecon.bsky.social · 27/10/2025

Arsenal Image Mounter's new Arm on Arm virtualization is powerful, unique, & a big deal for #DFIR practitioners. If you have Windows on Arm computers (or disk images) in your evidence room, time to get them out! What do you see in these screenshots? arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 27/10/2025

Arsenal Image Mounter v3.12.331 just released w/ Arm on Arm virtualization, Windows S Mode bypass (x64 & Arm!), multiple simultaneous disk connections w/ AIM Remote Agent, BitLocker support extended to Windows File System Driver Bypass Mode, & more. arsenalrecon.com #DFIR

010

Arsenal Recon @arsenalrecon.bsky.social · 13/10/2025

A major new build of Arsenal Image Mounter is just around the corner! Check out this brief teaser demonstration of forensically-sound Arm on Arm virtualization over a network. An enormous amount of effort over the summer went into making this happen. arsenalrecon.com #DFIR vimeo.com/1126823800

vimeo.com

Arsenal Image Mounter v3.12 Internal Build - Arm on Arm Virtualization Tease

Demonstrating safely booting an Arm laptop (Samsung Galaxy Book Go, Snapdragon 7c Gen 2 CPU - you may notice it has a broken screen) with WinFE, then running AIM…

100

Arsenal Recon @arsenalrecon.bsky.social · 13/10/2025

One of our favorite places to provide unique & in-person only digital forensics training is Microsoft. Beautiful classrooms, coffee bars always nearby, & a quick walk for Xbox R&R between classes. (Some computing history too!) #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 22/07/2025

We've been quiet on social media this summer... when this happens, we tend to be focused on adding unique & powerful functionality to our digital forensics tools & high-stakes casework. Can you identify one of our summer priorities for Arsenal Image Mounter from this image? #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 11/05/2025

Fellow #DFIR practitioners - what do you see happening in this short video involving WinFE, AIM Remote Agent, & Arsenal Image Mounter? arsenalrecon.com

000

Arsenal Recon @arsenalrecon.bsky.social · 10/05/2025

How do you connect AIM Remote Agent over a network to Arsenal Image Mounter on your forensic workstation when automatic discovery does not work (perhaps due to network filtering)? It's very easy - just use an IP address. See us demonstrate in this short video. #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 09/05/2025

Did you know that after booting a computer w/ WinFE, you can use AIM Remote Agent to connect it over a network to Arsenal Image Mounter on your forensic workstation w/ the same functionality as if the remote disk was a disk image or local physical disk? E.g. mounting VSCs! #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 08/05/2025

Headed back to the office after a few days at the Wisconsin ICAC conference where we provided training to digital forensics practitioners doing incredibly important work. We also learned more about how ESD (Electronic Storage Detection) K-9s are used & saw them in action. #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 04/05/2025

We're teaching & exhibiting at the Wisconsin ICAC (Internet Crimes Against Children) conference this week. Come see us & make a copy of our Password Sledgehammer database w/ >23 billion unique password hashes for use when launching virtual machines w/ Arsenal Image Mounter. #DFIR

100

Arsenal Recon @arsenalrecon.bsky.social · 28/04/2025

Watch Emina & Anastasia attach a disk image, an actual physical disk, & a remote disk to Arsenal Image Mounter & then launch each of them into a virtual machine with some of AIM's extremely powerful & unique functionality! vimeo.com/1079363782 #DFIR

vimeo.com

Arsenal Image Mounter v3.11.306 - Attaching Disk Images, Actual Physical Disks, & Remote Disks to AIM

Demonstrating the attachment of a disk image, an actual physical disk, and a remote disk to Arsenal Image Mounter.

000

Arsenal Recon @arsenalrecon.bsky.social · 25/04/2025

Arsenal Image Mounter v3.11.307 is now available with minor fixes & other improvements which include improved handling of corrupt Registry hives when launching virtual machines. See the change log for more information. arsenalrecon.com/downloads #DFIR

022

Arsenal Recon @arsenalrecon.bsky.social · 25/04/2025

Three years ago a law enforcement CTF team asked us about a disk image they were told was neutered & could not be launched into a virtual machine. Arsenal Image Mounter launched it into a VM fine & provided access to all the "suspect’s" secrets w/o Windows credentials. How? #DFIR

110

Arsenal Recon @arsenalrecon.bsky.social · 23/04/2025

Attending the National Cyber Crime Conference in Boston next week? Come see our presentations & chat at our booth! You can see “Disk Images are Gamblers and Virtualization is Vegas” on 4/30 11:30am, 5/1 10am, & 5/1 3:50pm. www.mass.gov/info-details... #NCCC2025 #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 23/04/2025

After connecting Arsenal Image Mounter to a remote disk over a network (w/ AIM Remote Agent) you may want to obtain a disk image. Emina & Anastasia use AIM itself to obtain a disk image in this video, but you could use any disk imaging tool you like! arsenalrecon.com #DFIR

010

Arsenal Recon @arsenalrecon.bsky.social · 22/04/2025

Did you know you can attach not only disk images, but actual physical disks & remote disks to Arsenal Image Mounter? Then leverage all of AIM's powerful & unique functionality against them - launching VMs, mounting VSCs using multiple methods, etc. arsenalrecon.com #DFIR

010

Arsenal Recon @arsenalrecon.bsky.social · 21/04/2025

We've shown how easy it is to connect disks to Arsenal Image Mounter over a network with AIM Remote Agent, now watch Emina & Anastasia launch remotely-connected disks into virtual machines! Notice the combination of reliable, powerful, & unique here? vimeo.com/1077264833 arsenalrecon.com #DFIR

vimeo.com

Arsenal Image Mounter - v3.11.303 WinFE and AIM Remote Agent - Launching Two Virtual Machines

Demonstrating two disks connected remotely to Arsenal Image Mounter being launched into virtual machines.

000

Arsenal Recon @arsenalrecon.bsky.social · 18/04/2025

How easy is it to boot computers with WinFE (Windows Forensic Environment) & use the new AIM Remote Agent to connect their disks to Arsenal Image Mounter over a network? Very easy - watch Emina & Anastasia do it! Then, imagine the possibilities... arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 03/04/2025

Have you seen the new AIM Remote Agent in action yet? Come see us April 29-May 1 at the 2025 National Cyber Crime Conference hosted by the MA Attorney General's Office or the Wisconsin ICAC Conference May 6-8... bring your laptop for some hands on! arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 01/04/2025

Arsenal Image Mounter v3.11.306 is now available with minor fixes & other improvements. See the change log for more detail. arsenalrecon.com/downloads #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 25/03/2025

Check out Emina doing some electronic evidence triage - booting a computer with WinFE, using AIM Remote Agent to connect it over a network to Arsenal Image Mounter on a forensic workstation, & finally running a Recon Report. arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 14/03/2025

Just received a great testimonial re: Arsenal Image Mounter from Australian law enforcement. The #DFIR community suggested they try AIM after having trouble launching forensic images into virtual machines with another tool... & now they are having success. arsenalrecon.com

000

Arsenal Recon @arsenalrecon.bsky.social · 12/03/2025

Did you know that Arsenal Image Mounter's Free Mode includes archive mounting as drive letters? arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 12/03/2025

Volume Shadow Copies (VSCs) from two remote disks mounted by Arsenal Image Mounter in a forensically-sound manner thanks to WinFE (Windows Forensic Environment) & AIM Remote Agent. arsenalrecon.com #DFIR

010

Arsenal Recon @arsenalrecon.bsky.social · 11/03/2025

Check out two remote disks launched into virtual machines by Arsenal Image Mounter after an ASUS laptop & TALINO workstation were booted with WinFE & their disks made available by AIM Remote Agent over a network. arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 11/03/2025

Check out our latest Insights article "Introducing AIM Remote Agent" for some compelling use cases, screenshots, & photos involving computers booted with WinFE (Windows Forensic Environment) & disks shared over networks with Arsenal Image Mounter. arsenalrecon.com/insights/int.... #DFIR

011

Arsenal Recon @arsenalrecon.bsky.social · 10/03/2025

Unlocking a remote disk's BitLocker-protected volume & then selecting virtual machine launch options, thanks to WinFE booting a laptop & AIM Remote Agent making its disk accessible to Arsenal Image Mounter over a network. arsenalrecon.com #DFIR

020

Arsenal Recon @arsenalrecon.bsky.social · 09/03/2025

Emina & Anastasia have been working on a nice series of AIM Remote Agent & WinFE screenshots & photos. Let's start w/ the initial connection of an agent to Arsenal Image Mounter (in this case, the second agent) & then viewing the remote disk details. arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 04/03/2025

Launching the "Compromised Windows Server 2022 (simulation)" disk image on CFReDS (cfreds.nist.gov/all/Benjamin...) into a virtual machine with Arsenal Image Mounter. This server is in a strange state, download & check it out for yourself! arsenalrecon.com #DFIR

010

Arsenal Recon @arsenalrecon.bsky.social · 04/03/2025

Bloomsburg University released another interesting CTF disk image this year during BloomCON 0x09. Here are some screenshots of Arsenal Image Mounter launching it into a virtual machine. Good hunting! arsenalrecon.com #DFIR

010

Arsenal Recon @arsenalrecon.bsky.social · 24/02/2025

Have you thought about how the new AIM Remote Agent could assist in your digital forensics workflow? Check out these use cases involving Windows Forensic Environment (WinFE). arsenalrecon.com #DFIR

000

Arsenal Recon @arsenalrecon.bsky.social · 20/02/2025

Check out the entire thread, now with small, but safe, steps to consider. #DFIR

000