We're building a new CTF (Capture the Flag) disk image incorporating technologies (e.g. Windows on Arm) & configurations not seen before in publicly-accessible disk images. Are there applications or configurations important to your casework that you would like us to add? #DFIR

Our latest in-person training “Windows Arm-on-Arm (WoA) Virtualization for Digital Forensics Practitioners” debuted last week, covering why we launch VMs from disk images (& actual & remotely-connected disks), peculiarities w/ WoA vs. x64, WinFE, BitLocker, S Mode, & more. #DFIR

"My client was stunned that he could see how the document looked over time just as the user had seen it, & asked if this was voodoo forensics! Leveraging VSCs launched into virtual machines was crucial to this matter & very jury friendly." See more: arsenalrecon.com/testimonials. #DFIR

In case you missed it last week, a new Arsenal Image Mounter (v3.12.331) has been released with a long list of improvements for #DFIR practitioners including Arm on Arm virtualization. You can see some highlights in our Insights article at arsenalrecon.com/insights/qui....

Check out this awesome testimonial regarding launching Windows Volume Shadow Copies (VSCs) into virtual machines with AIM! Have you tried this in your own #DFIR casework yet? arsenalrecon.com

Are you a #DFIR practitioner in the New England area? Want to see Arsenal Image Mounter’s new functionality in person? Contact us & let’s set something up soon so you can see Arm on Arm virtualization, AIM Remote Agent enhancements, & more! arsenalrecon.com

Do you have a digital forensics workstation running Windows on Arm (WoA) in your lab yet? We have some thoughts about this towards the end of our latest Insights article at arsenalrecon.com/insights/qui.... Let’s discuss! #DFIR

Check out our latest Insights article "Quick Tour Of New Features In Arsenal Image Mounter v3.12.331" to see highlights (lots of screenshots!) of the latest AIM functionality: arsenalrecon.com/insights/qui.... #DFIR

Did you know that AIM Remote Agent can be run from SUMURI's PALADIN? See Anastasia boot a Surface Pro 5 w/ two 512gb drives, connect both drives to AIM across a network (w/ automatic Storage Spaces reassembly), & launch a virtual machine. arsenalrecon.com #DFIR

Did you know that Arsenal Image Mounter running on Windows on Arm (WoA) can launch virtual machines across a network from WoA laptops & tablets (booted in a forensically-sound manner, e.g. w/ WinFE or PALADIN) thanks to AIM Remote Agent? See it now! arsenalrecon.com #DFIR

Do you know how many Arm-based laptops & tablets (other than those from Apple) are in your custody? Would you like an infographic to help identify them in the field & in your evidence room? Check out this article from Windows Central in the meantime: www.windowscentral.com/hardware/lap... #DFIR

Best Windows on ARM laptops in 2025

Want a new Windows laptop? You should consider one powered by an Arm processor. This is our roundup of the best Windows on Arm laptops on the market right now.

windowscentral.com

Keep in mind, AIM Remote Agent also runs on Windows on Arm… so in addition to attaching WoA disk images & actual physical disks to AIM locally, WoA disks can be connected to AIM across a network when their hosts are booted safely with (e.g.) WinFE! #DFIR

Arsenal Recon@arsenalrecon.bsky.social · 12mo ago

Are you a #DFIR practitioner? Take some time to focus on this screenshot. Windows on Arm laptops & tablets aren’t just coming, they’re here. The new Arsenal Image Mounter runs on WoA & seamlessly launches WoA disk images (& disks!) into virtual machines. arsenalrecon.com

Are you a #DFIR practitioner? Take some time to focus on this screenshot. Windows on Arm laptops & tablets aren’t just coming, they’re here. The new Arsenal Image Mounter runs on WoA & seamlessly launches WoA disk images (& disks!) into virtual machines. arsenalrecon.com

We know ICAC Task Forces (www.icactaskforce.org) encounter Arm-based computers often & will leverage Arsenal Image Mounter’s new Arm functionality in very important ways. As a reminder, we provide a free Arsenal license to every ICAC Task Force. arsenalrecon.com #DFIR

See the new Arsenal Image Mounter on a Samsung Galaxy Book Go (Snapdragon 7c Gen 2 CPU & only 4gb RAM!) launch a disk image from a Dell Inspiron 14 3420 (Snapdragon 8cx Gen 2, 8gb RAM) running Windows on Arm in S Mode into a virtual machine. Awesome. arsenalrecon.com #DFIR

Each Arsenal license purchased this week will come with a free seat of AIM Online Training (including one certification attempt) as we celebrate the release of the latest AIM yesterday. arsenalrecon.com #DFIR

Look closely at Arsenal Image Mounter running on Arm-based laptops & tablets from Microsoft, Dell, & Samsung with Snapdragon X Plus, X Elite, 8cx Gen 2, & 7c Gen 2 CPUs launching virtual machines from other Arm-based computers. Months of R&D now paying off for AIM users! #DFIR

Arsenal Recon@arsenalrecon.bsky.social · last yr.

Arsenal Image Mounter's new Arm on Arm virtualization is powerful, unique, & a big deal for #DFIR practitioners. If you have Windows on Arm computers (or disk images) in your evidence room, time to get them out! What do you see in these screenshots? arsenalrecon.com #DFIR

Do you have a #DFIR workstation running Windows on Arm? If you don’t now, you may soon after checking out Arsenal Image Mounter’s new Arm on Arm virtualization. While waiting on the Snapdragon X2 Elite, we're using a Dell XPS 13 (X Elite) with 64gb RAM. arsenalrecon.com

Arsenal Image Mounter's new Arm on Arm virtualization is powerful, unique, & a big deal for #DFIR practitioners. If you have Windows on Arm computers (or disk images) in your evidence room, time to get them out! What do you see in these screenshots? arsenalrecon.com #DFIR

Arsenal Image Mounter v3.12.331 just released w/ Arm on Arm virtualization, Windows S Mode bypass (x64 & Arm!), multiple simultaneous disk connections w/ AIM Remote Agent, BitLocker support extended to Windows File System Driver Bypass Mode, & more. arsenalrecon.com #DFIR

A major new build of Arsenal Image Mounter is just around the corner! Check out this brief teaser demonstration of forensically-sound Arm on Arm virtualization over a network. An enormous amount of effort over the summer went into making this happen. arsenalrecon.com #DFIR vimeo.com/1126823800

Arsenal Image Mounter v3.12 Internal Build - Arm on Arm Virtualization Tease

Demonstrating safely booting an Arm laptop (Samsung Galaxy Book Go, Snapdragon 7c Gen 2 CPU - you may notice it has a broken screen) with WinFE, then running AIM…

vimeo.com

One of our favorite places to provide unique & in-person only digital forensics training is Microsoft. Beautiful classrooms, coffee bars always nearby, & a quick walk for Xbox R&R between classes. (Some computing history too!) #DFIR

We've been quiet on social media this summer... when this happens, we tend to be focused on adding unique & powerful functionality to our digital forensics tools & high-stakes casework. Can you identify one of our summer priorities for Arsenal Image Mounter from this image? #DFIR

Fellow #DFIR practitioners - what do you see happening in this short video involving WinFE, AIM Remote Agent, & Arsenal Image Mounter? arsenalrecon.com

How do you connect AIM Remote Agent over a network to Arsenal Image Mounter on your forensic workstation when automatic discovery does not work (perhaps due to network filtering)? It's very easy - just use an IP address. See us demonstrate in this short video. #DFIR

Did you know that after booting a computer w/ WinFE, you can use AIM Remote Agent to connect it over a network to Arsenal Image Mounter on your forensic workstation w/ the same functionality as if the remote disk was a disk image or local physical disk? E.g. mounting VSCs! #DFIR

Headed back to the office after a few days at the Wisconsin ICAC conference where we provided training to digital forensics practitioners doing incredibly important work. We also learned more about how ESD (Electronic Storage Detection) K-9s are used & saw them in action. #DFIR

We're teaching & exhibiting at the Wisconsin ICAC (Internet Crimes Against Children) conference this week. Come see us & make a copy of our Password Sledgehammer database w/ >23 billion unique password hashes for use when launching virtual machines w/ Arsenal Image Mounter. #DFIR

Watch Emina & Anastasia attach a disk image, an actual physical disk, & a remote disk to Arsenal Image Mounter & then launch each of them into a virtual machine with some of AIM's extremely powerful & unique functionality! vimeo.com/1079363782 #DFIR

Arsenal Image Mounter v3.11.306 - Attaching Disk Images, Actual Physical Disks, & Remote Disks to AIM

Demonstrating the attachment of a disk image, an actual physical disk, and a remote disk to Arsenal Image Mounter.

vimeo.com

Arsenal Image Mounter v3.11.307 is now available with minor fixes & other improvements which include improved handling of corrupt Registry hives when launching virtual machines. See the change log for more information. arsenalrecon.com/downloads #DFIR