Fork me on GitHub

How to Mount ISO Files for Scanning

Dependency-Check can be used as one of your tools for vetting software distributed via an ISO image. (See File Type Analyzers for a list of what types of artifacts Dependency-Check is capable of scanning.) These disk image files are not a standard archive format, however. Tools must be used that can interpret the contained file system. As will be shown below, Linux, Mac OS X, and recent versions of Windows can be used to mount the image's file system, which can then be scanned by Dependency-Check.

ISO images are named for the fact that they nearly always contain one of a pair of international file system standards published by ISO: ISO 9660 and ISO/IEC 13346, a.k.a. UDF. Other types of disk images (e.g., VHD) are outside the scope of this article, though the ideas presented here may likely be successfully applied.


Assume you've downloaded an ISO image called foo.iso, and you want to mount it at /mnt/foo. (Why /mnt? See the Filesystem Hierarchy Standard.) First make sure that the mount point exists using mkdir /mnt/foo. Then, the mount command must be run with root privileges. On Debian and Ubuntu Linux, this is accomplished by prefacing the command with sudo.

$ sudo mount -o loop foo.iso /mnt/foo

Next, you can use Dependency-Check's command line tool to scan the mount point. When you are finished, run the umount command with root privileges:

$ sudo umount -d /mnt/foo

This will unmount the file system, and detach the loop device.

Mac OS X

Using the GUI

Simply double-click on the image file in Mac OS X Finder.

Using a Terminal Window

Use the hdiutil command.

$ hdiutil attach foo.iso

The output will show the /dev entry assigned as well as the mount point, which is where you may now read the files in the image's file system.

To detach:

$ hdiutil detach foo.iso


Windows 8 and later versions support mounting ISO images as a virtual drive.

Using the GUI

  1. In File Explorer, right-click on “foo.iso”.
  2. Select “Mount”

File Explorer then redirects to showing the files on your virtual drive. You can then use the command line tool to scan the virtual drive. When finished, “Windows-E” will open File Explorer showing the various drives on your computer. To eject the virtual drive:

  1. Right-click on the virtual drive.
  2. Select “Eject”

Using PowerShell

To mount, use the Mount-DiskImage cmdlet:

$ Mount-DiskImage -ImagePath C:\Full\Path\to\foo.iso

To view all drives (and find your virtual drive), use the Get-PSDrive cmdlet:

$ Get-PSDrive -PSProvider 'FileSystem'

To dismount, use the Dismount-DiskImage cmdlet:

$ Dismount-DiskImage -ImagePath C:\Full\Path\to\file.iso

Windows 7

Third-party tools exist that can be used to mount ISO images. Without such tools, it is still possible to burn the ISO image to physical media, and scan the media:

  1. Right-click on “foo.iso”
  2. Select “Windows Disc Image Burner”
  3. Follow the instructions to burn the image.

Windows Vista

Just as with Windows 7, you will need a third-party tool to mount an ISO image. You will also need a third-party tool to burn the image to media. Many machines are shipped with such a tool included.