Mounted Disk Images (ISO, IMG, VHD, VHDX)

What it is

Since Windows 8, double-clicking an .iso, .img, .vhd or .vhdx file mounts it as a new drive letter (VHD/VHDX could already be attached through Disk Management on Windows 7). Phishing campaigns abused this heavily from 2019 onwards: an ISO attached to an email or downloaded from a link carries a shortcut, a DLL and a decoy, and for years the files inside did not inherit the Mark-of-the-Web of the container. The mount itself is handled by the VHDMP (virtual disk miniport) driver and looks, to the rest of Windows, much like attaching a removable drive. That is why the investigation borrows most of its method from USB device forensics.

Location

What it proves

• Mount: VHDMP events name the full path of the image file that was surfaced as a disk, and when it was detached.
• Drive letter and volume: MountedDevices ties \DosDevices\E: to a Msft Virtual DVD-ROM or Msft Virtual Disk device, and MountPoints2 shows which user's Explorer saw the volume.
• File access and execution: LNK files and Jump Lists record targets on that drive letter with the image's volume serial number and label; Prefetch of a payload lists a CD-ROM or virtual volume device path.

It does not prove the user opened any file inside the image, and a mount event alone does not tell you who double-clicked. Attribution comes from MountPoints2, user-side LNK and Jump List entries, and the process that performed the mount. Third-party mounters (Daemon Tools, 7-Zip extraction) bypass VHDMP entirely.

Key fields

Timestamps

• VHDMP events: UTC. The commonly observed IDs are 1 (virtual disk surfaced / attached) and 2 (removed / detached), with other IDs such as 12 and 22 to 25 covering handle and lifecycle operations. IDs and message wording differ between builds, so verify on a reference system and read the event text.
• MountedDevices / MountPoints2 LastWrite (FILETIME, UTC): last time the key changed, which on the first mount is close to the mount time. A later mount of another image reusing the same letter overwrites the \DosDevices value.
• LNK files: creation of the .lnk in Recent marks first opening; the embedded target times come from the image's file system, often the attacker's build time, which is itself useful intelligence.
• The image file: $SI and $FN times in the $MFT and the Zone.Identifier stream give the download time and source.

Retention and clearing

The VHDMP Operational log is small (commonly about 1 MB) and overwrites quickly on hosts that use VHDX for FSLogix profiles or Hyper-V. MountedDevices keeps entries for volume GUIDs indefinitely unless cleaned. Detaching the image (event 2) or deleting the .iso removes the drive letter, but not LNK files, Jump List entries or Prefetch. Deleting the image leaves its name and deletion time in the USN journal.

Collection

KAPE targets EventLogs, RegistryHivesSystem, RegistryHivesUser and LNKFilesAndJumpLists, plus $MFT for the image file. On a live system:

Get-WinEvent -LogName 'Microsoft-Windows-VHDMP-Operational' -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Id, Message | Export-Csv E:\case\vhdmp.csv -NoTypeInformation
Get-WinEvent -LogName 'Microsoft-Windows-Partition/Diagnostic' -ErrorAction SilentlyContinue |
  Select-Object TimeCreated, Id | Export-Csv E:\case\partition.csv -NoTypeInformation
Get-ChildItem -Path C:\Users\*\Downloads, C:\Users\*\AppData\Local\Temp -Include *.iso,*.img,*.vhd,*.vhdx -Recurse -ErrorAction SilentlyContinue |
  ForEach-Object { $_.FullName; Get-Content -Path $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue }

reg query HKLM\SYSTEM\MountedDevices
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Preserve the image file itself: it is the payload container, and you can mount it read-only in a lab to see exactly what the user saw.

Parsing tools

• EvtxECmd for VHDMP, Partition/Diagnostic and Kernel-PnP events.
• Registry Explorer or RegRipper (mountdev, mp2 plugins) for MountedDevices and MountPoints2.
• LECmd and JLECmd to list targets whose drive type is CD-ROM or whose volume serial matches the image.
• PECmd to find payloads run from \VOLUME{...} or \DEVICE\CDROM* paths.
• MFTECmd for the image file and its Zone.Identifier alternate data stream.

Investigation tips

• Build the chain: download (browser history, Zone.Identifier) → mount (VHDMP 1, MountPoints2) → open (LNK with DRIVE_CDROM) → execution (Prefetch, 4688, Sysmon) → detach (VHDMP 2).
• Mark-of-the-Web: files inside ISO and VHD containers did not receive MotW before Microsoft's November 2022 updates (CVE-2022-41091). Patched builds propagate the container's zone to files opened from ISO images, but coverage for other formats and third-party tools varies. Do not expect a Zone.Identifier stream on files within the mounted volume: ISO9660/UDF has no ADS, so check the container.
• Prefetch of rundll32.exe, mshta.exe or cmd.exe referencing a file on a CD-ROM device path is a strong indicator of ISO-delivered execution.
• On VDI and Citrix hosts, VHDX mounts are routine (FSLogix profile containers); filter those paths before hunting.
• Compare the ISO volume label and creation time from LNK files across hosts to link infections to the same campaign.