AccessData AD Encryption (ADCRYPT)
| Format | AccessData AD Encryption (ADCRYPT) |
|---|---|
| Short name | ADCRYPT |
| Category | disk_image |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The encryption wrapper FTK Imager can put around an acquisition (raw or E01 segments, or an AD1 logical image). Each encrypted file starts with an 'ADCRYPT' header in a small unencrypted chunk; the content is AES-encrypted and opened with the password or the RSA private key (certificate) chosen at acquisition time.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 41 44 43 52 59 50 54 00 | ADCRYPT. | AD encryption header 'ADCRYPT' |
Known extensions
None recorded
References
- PRONOM fmt/843 — AccessData Custom Content Image (Encrypted) https://www.nationalarchives.gov.uk/PRONOM/fmt/843
- abrignoni/ewfprobe — pure-Python reader for EWF (E01, S01, Ex01, L01), AFF/AFF4, AD1 and virtual/Apple disk images https://github.com/abrignoni/ewfprobe
Cite this entry
Crush Format Reference, “AccessData AD Encryption (ADCRYPT)”. https://kalink0.github.io/crush-forensics/formats/adcrypt/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction