Android Boot Image
| Format | Android Boot Image |
|---|---|
| Short name | Boot image |
| Category | disk_image |
| Platforms | Android |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Android boot partition images (boot, recovery, init_boot, vendor_boot) consisting of a header followed by page-aligned kernel, ramdisk and, depending on the header version, further components. Header versions 0-2 (up to Android 10) can contain a second-stage loader, recovery DTBO (v1+) and DTB (v2); version 3 (Android 11) moves DTB and vendor ramdisk to the separate vendor_boot image ('VNDRBOOT'); version 4 (Android 12) adds a boot signature. The header contains the kernel command line and an OS version/security patch level field, which is zero on Android 13+ GKI devices. Boot images reveal the kernel and early init configuration a device boots with and can show modifications such as patched ramdisks used for rooting. On A/B devices, images exist per slot (_a/_b).
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 41 4E 44 52 4F 49 44 21 | ANDROID! | Boot image magic 'ANDROID!' |
| offset 0 (0x0) | 56 4E 44 52 42 4F 4F 54 | VNDRBOOT | Vendor boot image magic 'VNDRBOOT' |
Known extensions
None recorded
References
- Boot image header (Android Open Source Project) https://source.android.com/docs/core/architecture/bootloader/boot-image-header
- bootimg.h (AOSP mkbootimg source) https://android.googlesource.com/platform/system/tools/mkbootimg/+/refs/heads/main/include/bootimg/bootimg.h
Cite this entry
Crush Format Reference, “Android Boot Image”. https://kalink0.github.io/crush-forensics/formats/boot-image/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction