FTK Imager Logical Evidence (AD1)
| Format | FTK Imager Logical Evidence (AD1) |
|---|---|
| Short name | AD1 |
| Category | logical_image |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (LogicalEvidenceVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
AccessData (now Exterro) custom content image — a logical image of selected files and folders, not a disk: no partition table, no filesystem, no unallocated space, so deleted data is only included if it was selected as a file. Every segment (.ad1, .ad2, .ad3 …) begins 'ADSEGMENTEDFILE'; the first segment carries the logical image header 'ADLOGICALIMAGE'. Stores the file tree with names, timestamps, attributes and per-file hashes, with file content compressed in chunks. Can be protected with AD encryption (password or certificate); an encrypted image begins 'ADCRYPT' instead. Common for targeted and triage collections and for evidence handed over by other parties; the content can come from any system.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 41 44 53 45 47 4D 45 4E 54 45 44 46 49 4C 45 00 | ADSEGMENTEDFILE. | AD1 segment signature 'ADSEGMENTEDFILE', in every file of the set |
| offset 512 (0x200) | 41 44 4C 4F 47 49 43 41 4C 49 4D 41 47 45 | ADLOGICALIMAGE | Logical image header, in the first file of the set |
| offset 0 (0x0) | 41 44 43 52 59 50 54 | ADCRYPT | Encrypted AD1 (AD encryption header) |
Known extensions
.ad1
References
- pcbje/pyad1 — notes and reader for the AD1 format (work in progress) https://github.com/pcbje/pyad1
- Dissect — dissect.evidence.ad1 (AD1 reader) https://docs.dissect.tools/en/latest/api/dissect/evidence/ad1/index.html
- PRONOM fmt/842 — AccessData Custom Content Image https://www.nationalarchives.gov.uk/PRONOM/fmt/842
- PRONOM fmt/843 — AccessData Custom Content Image (Encrypted) https://www.nationalarchives.gov.uk/PRONOM/fmt/843
Cite this entry
Crush Format Reference, “FTK Imager Logical Evidence (AD1)”. https://kalink0.github.io/crush-forensics/formats/ad1/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction