Apple Encrypted Archive (AEA)
| Format | Apple Encrypted Archive (AEA) |
|---|---|
| Short name | AEA |
| Category | archive |
| Platforms | macOS, iOS |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Apple's archive container providing signing and/or encryption, selected by a profile ID in the header (signed-only, symmetric, ECDHE-based and password/scrypt-based variants). The payload is typically compressed and can be an Apple Archive or other data such as disk images. Signed-only archives (profile 0) are not encrypted; this profile is used, for example, for shared Shortcuts (.shortcut) since iOS 15. Encrypted archives are used for Apple software distribution, including root filesystem images in IPSWs (.dmg.aea) since iOS 18 / macOS 15; the header's authentication data contains the parameters needed to obtain the decryption key. Without the key, encrypted archives still establish presence, profile and provenance metadata, but not their contents.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 41 45 41 31 | AEA1 | AEA format signature 'AEA1' |
Known extensions
.aea, .shortcut
References
- Apple Encrypted Archive (The Apple Wiki) https://theapplewiki.com/wiki/Apple_Encrypted_Archive
- AEA guide (blacktop/ipsw documentation) https://blacktop.github.io/ipsw/docs/guides/aea
Cite this entry
Crush Format Reference, “Apple Encrypted Archive (AEA)”. https://kalink0.github.io/crush-forensics/formats/aea/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction