Microsoft Virtual Hard Disk (VHD)
| Format | Microsoft Virtual Hard Disk (VHD) |
|---|---|
| Short name | VHD |
| Category | disk_image |
| Platforms | Windows |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Virtual Hard Disk — a 512-byte footer starting 'conectix' at the end of the file describes the disk. Three types: fixed (the disk's bytes followed by the footer), dynamic (a copy of the footer at offset 0, a dynamic header and a block allocation table; blocks are allocated as written) and differencing (holds only the blocks changed since a parent VHD; the disk's content spans both files). Older Virtual PC versions split a VHD on FAT32 volumes into .v01, .v02 … files. Used by Virtual PC, early Hyper-V, Windows disk management and Windows Backup images. Mounts with a double-click since Windows 8 and is used as a container to deliver malware past Mark-of-the-Web (MITRE ATT&CK T1553.005).
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 63 6F 6E 65 63 74 69 78 | conectix | Footer cookie 'conectix' in the last 512 bytes |
| offset 0 (0x0) | 63 6F 6E 65 63 74 69 78 | conectix | Copy of the footer at offset 0, in a dynamic or differencing VHD |
Known extensions
.vhd, .avhd
References
- Virtual Hard Disk (VHD) image format — format documentation (libyal/libvhdi) https://github.com/libyal/libvhdi/blob/main/documentation/Virtual%20Hard%20Disk%20(VHD)%20image%20format.asciidoc
- Unsplitting a split virtual hard disk (Microsoft, Virtual PC Guy) https://learn.microsoft.com/en-us/archive/blogs/virtual_pc_guy/unsplitting-a-split-virtual-hard-disk
- ForensicsWiki — Virtual Hard Disk (VHD) https://forensics.wiki/virtual_hard_disk_(vhd)/
- MITRE ATT&CK T1553.005 — Mark-of-the-Web Bypass https://attack.mitre.org/techniques/T1553/005/
- abrignoni/ewfprobe — pure-Python reader for EWF (E01, S01, Ex01, L01), AFF/AFF4, AD1 and virtual/Apple disk images https://github.com/abrignoni/ewfprobe
Cite this entry
Crush Format Reference, “Microsoft Virtual Hard Disk (VHD)”. https://kalink0.github.io/crush-forensics/formats/vhd/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction