Windows Imaging Format (WIM / ESD)
| Format | Windows Imaging Format (WIM / ESD) |
|---|---|
| Short name | WIM |
| Category | archive |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
File-based image format for Windows installation media, deployment and backup images. A WIM can hold several images, each a complete directory tree with NTFS metadata such as timestamps, security descriptors and named data streams, plus XML metadata per image; identical content is stored only once. ESD files use the same format with solid LZMS compression. With WIMBoot (Windows 8.1 and later), files on a volume can be pointer files backed by a WIM.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 4D 53 57 49 4D 00 00 00 | MSWIM... | Header magic 'MSWIM' |
Known extensions
.wim, .esd, .swm
References
- wimlib documentation https://wimlib.net/man1/wimlib-imagex.html
- wimlib header.h (source with header layout) https://github.com/ebiggers/wimlib/blob/master/include/wimlib/header.h
Cite this entry
Crush Format Reference, “Windows Imaging Format (WIM / ESD)”. https://kalink0.github.io/crush-forensics/formats/wim/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction