Raw Disk Image
| Format | Raw Disk Image |
|---|---|
| Short name | Raw |
| Category | disk_image |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
A sector-for-sector copy of a disk, partition or flash chip with no container around it: no header, no metadata, no hash, no compression. Often split into numbered segments (.001, .002, … or other schemes such as .aa, .ab, …) that join into one stream. Everything the device held is in it, including unallocated space and slack; how and when it was acquired is only recorded outside the image.
Signatures
None recorded
Known extensions
.dd, .raw, .img, .001
References
- ForensicsWiki — Raw image format https://forensics.wiki/raw_image_format/
- SWGDE Best Practices for Computer Forensic Acquisitions (17-F-002, v2.0) — raw vs. container formats https://www.swgde.org/wp-content/uploads/2024/03/2023-06-15-SWGDE-Best-Practices-for-Computer-Forensic-Acquisitions-17-F-002-2.0.pdf
- dd (Unix) (Wikipedia) https://en.wikipedia.org/wiki/Dd_(Unix)
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “Raw Disk Image”. https://kalink0.github.io/crush-forensics/formats/raw/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction