# Install xmount with Homebrew, apt, dnf Convert between multiple input & output disk image types. Version 1.3.1 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:xmount ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install xmount ``` Evidence: local Homebrew formula metadata ### Linux - Debian apt (92%): ```sh sudo apt install xmount ``` Evidence: Debian stable package indexes: xmount from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install xmount ``` Evidence: Fedora Rawhide package metadata: xmount from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst ## Package facts - **Package key:** brew:xmount - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.3.1 - **Source summary:** Convert between multiple input & output disk image types - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-3.0-or-later - **Source archive:** - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - xmount (cli) - xmount (alias) ## Dependencies - afflib - libewf - libfuse - zlib-ng-compat ## Build dependencies - cmake - pkgconf ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 1.3.1 - Local data: ok - Upstream repository: https://www.sits.lu/xmount - info: No package-manager update timestamp was available. - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage xmount is a digital-forensics utility for exposing one disk-image format as another through FUSE. Its core trick is on-the-fly conversion: a raw, EWF, AFF, VDI, or QCOW-style evidence image can be mounted as a virtual raw, DMG, VHD, VDI, or VMDK-like image without first making a full converted copy. ### Project history The original project page at pinguin.lu describes the older xmount line, credits Guy Voncken for the idea and bug help, and notes that the project later moved to SITS. The current SITS page is the maintained project home and points to the SITS Git repository and releases. The SITS README documents a modernized 1.x architecture with external input libraries and morphing libraries. That design lets xmount support forensic formats through libraries such as libewf and AFF/AFF4 implementations while also handling operations such as combining multiple images, RAID0 reconstruction, byte swapping, and extraction of unallocated sectors. ### Adoption history xmount's adoption is forensic-practitioner adoption rather than mass developer adoption. It entered Debian/Ubuntu packaging, which the SITS page explicitly acknowledges, and it appears in security distributions such as Kali because investigators frequently need to bridge evidence-image formats and virtualization tools. SANS Internet Storm Center coverage captures the practical appeal: xmount is handy when a workflow needs DD, EWF, or AFF input and a format that can be consumed by analysis or virtualization tooling. The SITS page makes the same point with booting acquired images in QEMU, KVM, VirtualBox, or VMware while redirecting writes to a cache file. ### How it is used A typical xmount workflow mounts an acquired disk image read-mostly through FUSE, exposes a virtual output image in the requested format, and then attaches that output to forensic tools or a virtual machine. Virtual write support redirects changes into a cache file so the original evidence image is not modified. More advanced usage uses morphing: multiple image segments can be combined, RAID0 member disks can be reconstructed, and selected filesystem regions can be presented as a derived virtual image. That makes xmount useful in the awkward middle of a case, where evidence format, analysis tool, and hypervisor all expect different disk-image conventions. ### Why package nerds care xmount is a good example of a package that exists because copying giant images is the wrong abstraction. The package value is not a new archive format; it is the Unix move of presenting a virtual filesystem facade over messy real-world evidence formats. For package nerds, it also sits at the crossroads of FUSE, forensic image libraries, and VM disk formats. Installing one CLI can remove several slow, lossy, or storage-heavy conversion steps from an incident-response workstation. ### Timeline - Pre-2024: The original pinguin.lu project page documents xmount 0.7-era features such as CMake, multiple input images, image morphing, and internal EWF support. - 2024-03-13: The current SITS GitLab project is created. - 2024-2026: The SITS README copyright span and releases document the maintained 1.x line under SITS. - 2020s: xmount remains packaged in forensic/security-oriented distributions for mounting and converting evidence disk images through FUSE. ### Related projects - Guymager is the forensic acquisition tool credited by xmount's project pages and linked from the acknowledgments. - libewf and afflib provide support for common forensic evidence image formats used by xmount. - FUSE is the user-space filesystem layer that lets xmount present virtual converted disk images without writing a full output copy. - QEMU, KVM, VirtualBox, and VMware are common consumers of xmount's virtual output images. ### Sources - - - - - - ## Security Notes broad file, network, media, or database tool signal. - **Geiger risk:** blue / medium - broad file, network, media, or database tool signal ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** xmount - **Version Scheme:** 0 - **Revision:** 0 - **Requirements:** linux - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Debian apt - xmount - 1.2.0+ds-1+b1: normalized package name match | Debian stable package indexes: xmount from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | tool for crossmounting between disk image formats | https://www.sits.lu/xmount - Ubuntu apt - xmount - 0.7.6-3build2: normalized package name match | Ubuntu 24.04 LTS package indexes: xmount from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | tool for crossmounting between disk image formats | https://www.pinguin.lu/ - dnf - xmount - 1.2.0-6.fc44: normalized package name match | Fedora Rawhide package metadata: xmount from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | A on-the-fly convert for multiple hard disk image types | https://www.sits.lu/xmount ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://www.automicvault.com/pkg/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [afflib](https://www.automicvault.com/pkg/brew/afflib/) - Runtime dependency declared by Homebrew. - [libewf](https://www.automicvault.com/pkg/brew/libewf/) - Runtime dependency declared by Homebrew. - [libfuse](https://www.automicvault.com/pkg/brew/libfuse/) - Runtime dependency declared by Homebrew. - [cmake](https://www.automicvault.com/pkg/brew/cmake/) - Build dependency declared by Homebrew. - [pkgconf](https://www.automicvault.com/pkg/brew/pkgconf/) - Build dependency declared by Homebrew. - [bulk_extractor](https://www.automicvault.com/pkg/brew/bulk-extractor/) - Shares av.db curated category or tags: cli, digital-forensics, forensics, security. - [foremost](https://www.automicvault.com/pkg/brew/foremost/) - Shares av.db curated category or tags: cli, digital-forensics, forensics, security. - [regipy](https://www.automicvault.com/pkg/brew/regipy/) - Shares av.db curated category or tags: cli, digital-forensics, forensics, security. - [sleuthkit](https://www.automicvault.com/pkg/brew/sleuthkit/) - Shares av.db curated category or tags: cli, digital-forensics, forensics, security. - [binwalk](https://www.automicvault.com/pkg/brew/binwalk/) - Shares av.db curated category or tags: cli, forensics, security. - [chainsaw](https://www.automicvault.com/pkg/brew/chainsaw/) - Shares av.db curated category or tags: cli, forensics, security. ## Combined YAML source View the package source record on GitHub. [combined/xmount.yml](https://github.com/automic-vault/db/blob/main/combined/xmount.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph