BMP Image
| Format | BMP Image |
|---|---|
| Short name | BMP |
| Category | media |
| Platforms | Windows |
| Crush support | Supported (ImageParser) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Uncompressed bitmap format common in Windows apps, legacy software, and some screenshot tools. The BITMAPFILEHEADER declares the file size at offset 2 — any discrepancy between this value and actual file size indicates appended data or truncation. BMP has no EOF marker, so trailing data detection relies entirely on this size field. Pixel data is stored bottom-up by default — row order matters for carving. Can use RLE compression for 4-bit and 8-bit images. Very rare on modern mobile devices — presence in an acquisition may itself be noteworthy. Widely used in Windows clipboard operations and legacy software.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 42 4D | BM | BMP file header signature ('BM') |
Known extensions
.bmp, .dib
References
- BMP format spec (Microsoft) https://learn.microsoft.com/en-us/windows/win32/gdi/bitmap-storage
- BITMAPFILEHEADER structure (Microsoft) https://learn.microsoft.com/en-us/windows/win32/api/wingdi/ns-wingdi-bitmapfileheader
- BMP format (Wikipedia — comprehensive) https://en.wikipedia.org/wiki/BMP_file_format
- BMP format (Kaitai Struct — formal spec) https://formats.kaitai.io/bmp/
Cite this entry
Crush Format Reference, “BMP Image”. https://kalink0.github.io/crush-forensics/formats/bmp/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction