VirtualBox Disk Image (VDI)
| Format | VirtualBox Disk Image (VDI) |
|---|---|
| Short name | VDI |
| Category | disk_image |
| Platforms | Windows, macOS, Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Virtual disk format of Oracle VirtualBox. A 64-byte text header (e.g. '<<< Oracle VM VirtualBox Disk Image >>>', older 'innotek' or 'Sun' variants) is followed by the signature and a header with image type, disk geometry, a block map and the UUIDs of the image, its last snapshot, link and parent. Dynamic images only allocate blocks that were written; snapshots are stored as differencing images that reference their parent by UUID, so a complete disk state may require the whole image chain.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 3C 3C 3C 20 | <<< | Start of the text header '<<< … VirtualBox Disk Image >>>' |
| offset 64 (0x40) | 7F 10 DA BE | .... | Image signature 0xBEDA107F (little-endian) |
Known extensions
.vdi
References
- QEMU VDI block driver (source with header layout) https://github.com/qemu/qemu/blob/master/block/vdi.c
Cite this entry
Crush Format Reference, “VirtualBox Disk Image (VDI)”. https://kalink0.github.io/crush-forensics/formats/vdi/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction