Android Sparse Image
| Format | Android Sparse Image |
|---|---|
| Short name | simg |
| Category | disk_image |
| Platforms | Android |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Android's space-efficient flash image format that replaces empty and repetitive blocks with metadata chunks, reducing image size for transmission and fastboot flashing. Used in factory images (Google, Samsung, OEM), OTA update packages, and custom ROM distributions. 28-byte header (magic 0xED26FF3A) specifies block size (typically 4096 bytes), total output blocks, and chunk count. Four chunk types: RAW (data), FILL (repeated 4-byte pattern), DONT_CARE (empty/unwritten blocks), and CRC32 (checksum). Must be converted to raw (e.g. ext4/f2fs) before mounting or forensic analysis. Large images are sometimes split into multiple sparse chunks that must be reassembled before conversion. Forensically relevant as the delivery container for Android system partitions (system.img, vendor.img, product.img) — useful for comparing suspect device partitions against factory baselines.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 3A FF 26 ED | :.&. | Android sparse image magic (0xED26FF3A little-endian) |
Known extensions
.img, .simg
References
- Android sparse image format (libsparse — AOSP source) https://android.googlesource.com/platform/system/core/+/refs/heads/main/libsparse/
- Android sparse image format explained (2net.co.uk, csimmonds, 2014) https://2net.co.uk/tutorial/android-sparse-image-format
- Formal sparse format specification (Kaitai Struct) https://formats.kaitai.io/android_sparse/
- simg2img — standalone converter (anestisb/android-simg2img) https://github.com/anestisb/android-simg2img
Cite this entry
Crush Format Reference, “Android Sparse Image”. https://kalink0.github.io/crush-forensics/formats/simg/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction