Microsoft Virtual Hard Disk v2 (VHDX)
| Format | Microsoft Virtual Hard Disk v2 (VHDX) |
|---|---|
| Short name | VHDX |
| Category | disk_image |
| Platforms | Windows |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Virtual Hard Disk v2 — the successor of VHD. Begins with the file type identifier 'vhdxfile', followed by two redundant headers, a log for crash consistency, a block allocation table and a metadata region. Fixed, dynamic and differencing disks as in VHD; a differencing disk holds only the blocks changed since its parent. Used by Hyper-V, Windows disk management and backup products. WSL 2 stores each Linux distribution as ext4.vhdx under %LOCALAPPDATA%\Packages\…\LocalState\, and Docker Desktop stores its data in a VHDX, so a Windows host can hold complete Linux filesystems. Mounts with a double-click and is used to deliver malware past Mark-of-the-Web.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 76 68 64 78 66 69 6C 65 | vhdxfile | VHDX file type identifier 'vhdxfile' |
Known extensions
.vhdx, .avhdx
References
- [MS-VHDX]: Virtual Hard Disk v2 (VHDX) File Format (Microsoft) https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-vhdx/
- Virtual Hard Disk version 2 (VHDX) image format — format documentation (libyal/libvhdi) https://github.com/libyal/libvhdi/blob/main/documentation/Virtual%20Hard%20Disk%20version%202%20(VHDX)%20image%20format.asciidoc
- MITRE ATT&CK T1553.005 — Mark-of-the-Web Bypass https://attack.mitre.org/techniques/T1553/005/
- abrignoni/ewfprobe — pure-Python reader for EWF (E01, S01, Ex01, L01), AFF/AFF4, AD1 and virtual/Apple disk images https://github.com/abrignoni/ewfprobe
Cite this entry
Crush Format Reference, “Microsoft Virtual Hard Disk v2 (VHDX)”. https://kalink0.github.io/crush-forensics/formats/vhdx/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction