What Is a Disk Image? Find the Format From Its First Bytes, Then Open the Disk Image
Disk images are files that store full copies of disks, discs or drives, with their files and layout. Jump to your question below, or work through it in order.
What Is a Disk Image? Full disk copies in one file, saved in several layouts
Short answer
A disk image is a file with a full copy of a disk, disc or drive, in one piece or in several parts. Disk images keep the files and also the layout around them, like the partition table and the file system. Backups, virtual machines, forensic cases, software installers and old game discs all use disk images.
The ending does not name the kind, so read the first bytes. Virtual disks and evidence files name themselves at byte 0. ISO files spell CD001 at byte 32,769. In our tests, no single reader opened all 18 good disk images. 7-Zip opened 14, Sleuth Kit 12 and the qemu-img route 10.
To find your kind, read the first-byte check. To look inside one, read how to open disk images. To check a disk image, read the hash steps. If your disk image is damaged, start with the damage tests.
A disk image is one file, or several, that stores the full contents of disks or discs, with the partition table and file system. Tools mount disk images like drives or unpack them like archives.
Picture a laptop you must back up before repair, and Linux installers you download for USB sticks. The laptop copy is saved as one large file you can restore later. The installer is an ISO file that a USB tool writes to the stick. Both are disk images.
FileInfo lists disk image files as containers with a full copy of a disk or other media, and its list goes from .iso and .dmg to .vdi, .vmdk and .vhd. Wikipedia adds that early disk images were bit-by-bit copies of every sector, and that many newer formats store only the blocks in use.
So the word covers two families. Raw disk images copy every byte, so 40 MiB disks make 40 MiB files. Container formats wrap the data in headers and tables. They can grow as needed, compress, split into parts or add hashes and case notes. Our tests built both families.
Disk image facts at a glance
| Property | Value |
|---|---|
| Meaning | One file or several with the full contents of disks, discs or drives |
| Common endings | .img, .iso, .dmg, .vhd, .vhdx, .vmdk, .vdi, .qcow2, .E01, .bin and .mdf |
| Families | Raw copies, and container formats like VHD, VMDK, QCOW2 and E01 |
| Made by | Backup tools, disk copy tools, virtual machine software and disc burners |
| Starts with | It depends on the kind. Some name themselves at byte 0, ISO files at byte 32,769, and a fixed VHD at the end. Raw disk images have no name at all. |
| Opens in | 7-Zip, Sleuth Kit, qemu-img with a mount, the mount commands of Windows and macOS, and disc tools |
| Hash | You can hash the file. Hash it when you make it and again before you trust it. |
| Safe to open | Listing the files is low risk. Starting a computer from a disk image executes the code inside it, so boot only disk images you trust. |
Wrong page? A raw disk image made with the dd tool has its own page, the DD file guide. Mac installers end in .dmg, and the DMG file guide covers them. Ordinary archives are in the ZIP file guide.
Which Kind of Disk Image Is Yours? Three places in the file name the kind
Read three places in the file: the first 8 bytes, the 5 bytes at byte 32,769 and the last 512 bytes. Virtual disks and evidence files name themselves at byte 0, ISO files at byte 32,769, and a fixed VHD or a DMG in the last 512 bytes.
The ending can mislead. In our tests, a raw disk image saved as .vhd and a QCOW2 file saved as .iso both opened once we ignored the ending and used the right format. The script below reads the three places, names the kind and lists any problem it can see. Save it as check_image.py and give it the name of your disk image.
import os, struct, sys
SIG = [
(0, b'conectix', 'VHD, footer copy at the start', 'VHD'),
(0, b'vhdxfile', 'VHDX', 'VHDX'),
(0, b'KDMV', 'VMDK, sparse extent', 'VMDK'),
(0, b'# Disk DescriptorFile', 'VMDK descriptor, a text file that names extent files', 'VMDK'),
(0, b'<<<', 'VDI', 'VDI'),
(0, b'QFI\xfb', 'QCOW2', 'QCOW2'),
(0, b'EVF\x09\x0d\x0a\xff\x00', 'E01', 'E01'),
(0, b'\x1f\x8b', 'Gzip, perhaps a compressed disk image', 'GZ'),
(0, b'FILE "', 'CUE sheet, a text file that names a BIN file', 'CUE'),
(0, b'\x00' + b'\xff' * 10 + b'\x00', 'BIN, raw CD sectors of 2,352 bytes', 'BIN'),
(32769, b'CD001', 'ISO 9660, a CD or DVD image', 'ISO'),
]
ENDING = {'.vhd': 'VHD', '.vhdx': 'VHDX', '.vmdk': 'VMDK', '.vdi': 'VDI', '.qcow2': 'QCOW2', '.e01': 'E01', '.iso': 'ISO', '.bin': 'BIN', '.gz': 'GZ', '.cue': 'CUE'}
def read(f, off, n):
f.seek(off)
return f.read(n)
def check(path):
size = os.path.getsize(path)
if size == 0:
return 'Empty file', ['the file has no bytes']
kind, short, problems = 'Not recognized', None, []
with open(path, 'rb') as f:
for off, sig, name, tag in SIG:
if read(f, off, len(sig)) == sig:
kind, short = name, tag
break
if short is None and size >= 512:
if read(f, size - 512, 8) == b'conectix':
kind, short = 'VHD, footer at the end', 'VHD'
elif read(f, size - 512, 4) == b'koly':
kind, short = 'DMG, trailer at the end', 'DMG'
elif read(f, 510, 2) == b'\x55\xaa':
kind, short = 'Raw disk image with a partition table', 'RAW'
if short == 'VHD' and read(f, size - 512, 8) != b'conectix':
problems.append('no footer at the end')
if short == 'VHD' and read(f, 0, 512) == bytes(512):
problems.append('first 512 bytes are zeros, a dynamic VHD repeats the footer there')
if short == 'VDI' and read(f, 64, 4) != b'\x7f\x10\xda\xbe':
problems.append('VDI signature at byte 64 is missing')
if short == 'ISO':
blocks = struct.unpack('<I', read(f, 32768 + 80, 4))[0]
if size < blocks * 2048:
problems.append(f'file is shorter than the {blocks * 2048:,} bytes the volume says')
if short == 'BIN' and size % 2352:
problems.append('size is not a multiple of 2,352')
if short == 'VMDK' and kind.startswith('VMDK descriptor'):
for line in open(path, errors='replace'):
if line.startswith(('RW ', 'RDONLY ')) and '"' in line:
name = line.split('"')[1]
if not os.path.exists(os.path.join(os.path.dirname(path) or '.', name)):
problems.append(f'extent file {name} is missing')
if short is None:
problems.append('no known signature at the start or the end')
ext = os.path.splitext(path)[1].lower()
if ext in ENDING and short and ENDING[ext] != short:
problems.append(f'ending {ext} says {ENDING[ext]}, bytes say {short}')
elif ext in ENDING and short is None:
problems.append(f'ending {ext} says {ENDING[ext]}')
return kind, problems
for p in sys.argv[1:]:
kind, problems = check(p)
with open(p, 'rb') as f:
first = f.read(8).hex(' ')
print(p)
print(' First 8 bytes:', first)
print(f' Size on disk: {os.path.getsize(p):,} bytes')
print(' Kind:', kind)
print(' Problems:', '; '.join(problems) if problems else 'none found')python check_image.py i03-vhd-dynamic.vhd
i03-vhd-dynamic.vhd
First 8 bytes: 63 6f 6e 65 63 74 69 78
Size on disk: 6,295,552 bytes
Kind: VHD, footer copy at the start
Problems: none foundWe tried the script on all 20 files of the 18 good disk images and on all 20 damaged disk images. It found no problem in the good files, and it flagged 13 of the 20 damaged cases. It cannot see flipped bytes, cut QCOW2 files, padded ISO files or wrong BIN/CUE modes. The section on damaged files lists all 20.
python check_image.py d02-vhd-dyn-end-footer-zeroed.vhd
d02-vhd-dyn-end-footer-zeroed.vhd
First 8 bytes: 63 6f 6e 65 63 74 69 78
Size on disk: 6,295,552 bytes
Kind: VHD, footer copy at the start
Problems: no footer at the end| Kind | Where to look | What you see |
|---|---|---|
| VHD, dynamic | Bytes 0 to 7 and the last 512 bytes | The text conectix in both places |
| VHD, fixed | The last 512 bytes | The text conectix. The rest is a raw disk. |
| VHDX | Bytes 0 to 7 | The text vhdxfile |
| VMDK | Bytes 0 to 3 | The text KDMV. Split disks start with the text # Disk DescriptorFile instead. |
| VDI | Bytes 0 to 2 and byte 64 |
The text <<< at the start and 7f 10 da be at byte 64
|
| QCOW2 | Bytes 0 to 3 |
51 46 49 fb, the text QFI and one more byte
|
| E01 | Bytes 0 to 7 |
45 56 46 09 0d 0a ff 00, the text EVF and five more bytes
|
| ISO 9660 | Bytes 32,769 to 32,773 | The text CD001 |
| DMG | The last 512 bytes | The text koly, says Wikipedia. We did not test it. |
| Gzip file | Bytes 0 and 1 |
1f 8b. A raw disk image may be inside.
|
| Raw disk image | Bytes 510 and 511 |
55 aa, the end of the first sector
|
| Wiped start | Bytes 0 to 7 | Zero bytes only |
Four more clues about your disk image
What Is Inside Disk Images? Raw copies, sparse containers, evidence files and discs
Disk images store the same disk in several layouts: raw copies, sparse containers, evidence files, disc images or text descriptors with extent files. The layout sets the file size and the programs that can open it.
Think of a bookshelf with 640 slots and 10 books. A raw disk image photographs all 640 slots. Sparse containers list the 10 slots in use and the books in them. Compressed containers squeeze the books too. Descriptors with extents are index cards that point to boxes of books.
| Layout | Size in bytes | What it stores |
|---|---|---|
| Raw copy | 41,943,040 | Every byte of the disk in order, with no header |
| Raw plus footer | 41,943,552 | Fixed VHD: the raw bytes, then a 512-byte footer |
| Evidence file | 41,961,855 | An E01 file: the disk in pieces with checks, a hash and case notes |
| Sparse container | VHDX 16,777,216, dynamic VHD 6,295,552, VDI 4,195,328, QCOW2 983,040 and VMDK 720,896 | Maps of blocks, with only the blocks in use |
| Compressed | QCOW2 536,576, E01 422,724, stream VMDK 324,608 and gzip of the raw copy 242,213 | The same data, squeezed |
| Descriptor and extents | 512 plus 720,896 | Split VMDK: a text file that names the extent files |
| Disc image | 565,248 to 1,075,200 | An ISO file with only our 4 test files, in 2,048-byte sectors |
Only about 1.6 percent of our test disk contains data. The check of the QCOW2 file showed 10 of 640 clusters in use, and that is why sparse formats came out so much smaller than the raw copy.
Raw disk images
A raw disk image has no header. Its first 512 bytes are the first sector of the disk, and an MBR disk ends that sector with 55 aa. Ours had one ext4 partition that starts at sector 2,048, which is byte 1,048,576. Sleuth Kit needed that start sector from us. 7-Zip read the partition table by itself.
Sparse and compressed disk images
Wikipedia on QCOW says QCOW files grow as data is written, so they stay smaller than raw disk images. We saw the same in the other sparse formats. Compression shrank the used blocks further: the compressed QCOW2 file was 536,576 bytes and the stream VMDK only 324,608 bytes.
Empty space also shrinks well after the fact. Gzip took our raw disk image from 41,943,040 bytes down to 242,213 bytes. That is the smallest file in the set, but you must unpack it before most tools can read it.
VHD footers
Wikipedia on VHD says fixed VHD files are raw disk images followed by a 512-byte footer, and dynamic VHD files begin with a copy of that footer. We saw both. This matters when a footer is damaged, because different readers trust different copies. The damage results show how that played out. Microsoft's page on the VHD format names fixed, expandable and differencing types.
Evidence disk images
E01 files are disk images from forensic tools. In our files, the disk is cut into pieces of 64 sectors, which is 32 KiB. The file also stores an MD5 hash of the entire disk and case notes. When we flipped one byte, ewfverify named the damaged piece: 64 sectors.
The MD5 hash stored in our E01 disk images matched the data. The SHA-256 field showed N/A, so ewfverify calculated a SHA-256 hash but had nothing to compare it with.
Disc images
ISO files copy the data tracks of CDs and DVDs in 2,048-byte sectors. Wikipedia on ISO 9660 says the first 16 sectors, 32,768 bytes, are unused by the standard, and every volume descriptor starts with CD001. So the text is at byte 32,769, after the one-byte type. We built four kinds: level 1 names, Joliet and Rock Ridge names, UDF and one bootable image.
BIN files are different. They store raw CD sectors of 2,352 bytes, and small CUE text files name them and set their mode. We made our BIN by wrapping every sector of the Joliet ISO in a 2,352-byte frame with 288 zero bytes for error codes. Discs copied from physical drives would store true error codes, so treat our BIN as a test of the layout only.
Descriptor files and extents
Some VMDK files are split. Wikipedia on VMDK says descriptors list extents, and the extents point to the files that store the data. Ours was a 512-byte text file named i10.vmdk and a 720,896-byte extent file. If the extent file loses its name, the descriptor points to nothing. The VMDK file guide covers that format in more depth.
What Do 38 Test Disk Images Show? 18 good disk images, 20 damaged copies and four readers
No single reader opened all 18 good disk images we built. 7-Zip returned all four test files from 14 of them, Sleuth Kit from 12 and qemu-img with a mount from 10. The ISO tools read all 4 ISO files. Then we tried the same readers on 20 damaged copies.
We found no public set of disk images with known content to test, so we built our own on Ubuntu 24.04 in October 2026. Every disk image got the same four files: hello.txt with 28 bytes, notes.txt with 44, report.txt with 1,150 and photo.bin, a binary file of 200,000 random bytes. Most disk images are 40 MiB disks with an MBR and one ext4 partition. The ISO files are small.
We damaged copies in 20 ways and tried four readers on all 38 disk images. The readers were 7-Zip 23.01, The Sleuth Kit 4.12.1, qemu-img 8.2.2 with a loop mount, and bsdtar 3.7.2 with xorriso 1.5.6 for ISO files. A file counted as returned only when its SHA-256 hash matched the original.
We did not test Windows or macOS tools, DMG, NRG, MDF/MDS or Toast images, encrypted disk images, disk images over 40 MiB or discs from a physical drive. Our VDI came from QEMU, not VirtualBox. Our kernel could not mount ISO or UDF, so those were read with 7-Zip, Sleuth Kit, bsdtar and xorriso. We did not start the SysTools or Freeviewer viewers either.
The 18 good disk images we built
| Disk image | What it is and tests |
|---|---|
| Raw | A raw copy with an MBR and one ext4 partition. 41,943,040 bytes. |
| Fixed VHD | Raw bytes plus a footer at the end. 41,943,552 bytes. |
| Dynamic VHD | A footer at both ends. 6,295,552 bytes. |
| VHDX | The newer Microsoft format. 16,777,216 bytes. |
| VMDK sparse | One sparse file. 720,896 bytes. |
| VMDK stream | Stream optimized. 324,608 bytes. |
| VMDK split | A 512-byte descriptor and one 720,896-byte extent. |
| VDI | Made by QEMU. 4,195,328 bytes. |
| QCOW2 | Not compressed. 983,040 bytes. |
| QCOW2 compressed | Zlib compression. 536,576 bytes. |
| E01 | No compression. 41,961,855 bytes. |
| E01 deflate | Fast deflate. 422,724 bytes. |
| Gzip raw | The raw copy in a gzip file. 242,213 bytes. |
| ISO level 1 | Short upper-case names. 565,248 bytes. |
| ISO Joliet and Rock Ridge | Long names. 581,632 bytes. |
| ISO UDF | The UDF file system. 1,075,200 bytes. |
| ISO bootable | An El Torito boot entry. 587,776 bytes. |
| BIN and CUE | Raw 2,352-byte sectors and a 71-byte CUE file. 667,968 bytes. |
The four test files were the same in every disk image. Every reader that found them gave back the same bytes, so the counts below show what these readers can open and not what they can restore.
| Reader | Disk images read | Note |
|---|---|---|
| 7-Zip | 14 of 18 | No stream VMDK, no E01 files and no BIN/CUE. Gzip took two passes. |
| Sleuth Kit | 12 of 18 | Raw, VHD, VMDK, E01 and ISO only. It lists no VHDX, VDI, QCOW2 or gzip type. |
| qemu-img and a mount | 10 of 10 it supports | Every raw, VHD, VHDX, VMDK, VDI and QCOW2 file. It cannot read E01, gzip or ISO files. |
| bsdtar and xorriso | 4 of 5 | All 4 ISO files, and neither read the BIN file. |
7-Zip opened raw, VHD, VHDX, VMDK, VDI and QCOW2 files in one pass, and it opened ISO and UDF files too. It read the gzip file in two passes: the gzip layer first, then the raw disk image inside. It stopped with exit code 2 on the stream VMDK and on both E01 files.
The BIN and CUE pair was the one disk image that no reader opened as it was. After bchunk converted it to ISO, the result had the same SHA-256 hash as the Joliet ISO we built it from. All told, 17 of the 18 good disk images were read by at least one reader as they were.
The 20 damaged disk images
We damaged copies of the good disk images in 20 ways, with one kind of damage in every case. Seven hit the start or a footer of a virtual disk, four hit names or side files, four flipped bytes, four cut or wiped data and one was harmless. The full list of 20 cases gives the fix for every case.
| Damage (cases) | Before repair | After repair |
|---|---|---|
| Start or footer of a virtual disk (7) | 3 | 7 |
| Names and side files (4) | 2 | 4 |
| A flipped byte (4) | 1 | 1 |
| Cut, emptied or volume start wiped (4) | 0 | 0 |
| Harmless padding (1) | 1 | 1 |
| All 20 cases | 7 | 13 |
Before repair means at least one reader returned all four files from the damaged disk image. After repair means the same check after one small fix on a copy. Six cases gained, and every fix took a few bytes or one command.
Seven stayed incomplete after our best repair. They were the QCOW2 file cut in half, the ISO with a zeroed volume descriptor, the ISO cut at 250,000 bytes and the empty file. The other three had a flipped byte inside photo.bin or the compressed data.
Read the counts with care. We damaged small disk images with simple breaks. Failing drives, bad downloads and half-finished copies do messier harm. The numbers show how these readers behave with these disk images, and they are not rates for all disk images.
What Does Our Expert Say About Disk Images? A note from Neeraj Singh on hashing before you trust a copy
Hash a disk image when you make it, and check the hash again before you trust a copy. In our tests, one flipped byte inside an E01 file passed Sleuth Kit with no error, and only ewfverify named the damage.
Expert insight
“A disk image is a container around a disk, and the container can fail in places the disk never shows. In our 20 damaged disk images, a VHD with one footer wiped opened in one reader and failed in two others. One flipped byte in an E01 file still gave back all four files, and only the stored hash showed the damage. Hash every disk image when you make it, and check it again before you trust it.”
Why a quiet result can still be wrong
Sleuth Kit returned all four test files from the E01 disk image with a flipped byte in empty space, and it raised no error. Then ewfverify said FAILURE. It named the damaged range of 64 sectors, and it showed that the MD5 hash of the data no longer matched the hash stored in the file.
The raw disk image with one flipped byte inside photo.bin was quieter still. 7-Zip, Sleuth Kit and the qemu-img route all returned photo.bin at its full size of 200,000 bytes with one byte wrong. Raw disk images have no check value, so only a hash comparison finds the change.
Both cases have the same defense. Hash the disk image when you make it and save the hash in a separate place. Compare it later with sha256sum. The verify section shows the steps for raw, virtual disk and E01 files.
Our script missed 7 of the 20 damaged disk images. One was harmless: the padded ISO, which every reader opened. The rest were flipped bytes, cut files or wrong settings in side files, and a check of the first and last bytes cannot see those.
Keep the original. Work on copies of disk images, and keep the first hash. If a repair goes wrong, you can start again. Mount copies as read-only, so no tool writes to them.
How Do You Open Disk Images? 7-Zip, Sleuth Kit or a mount, with nothing written back
Open disk images with 7-Zip to list and copy files, with Sleuth Kit for forensic disk images or with a mount to use them like drives. No single reader opened every kind in our tests, so match the reader to the kind.
Opening a disk image is different from restoring it or booting from it. Opening lists the files and copies some out, and nothing is written back to the source. The table lists the ways we tried and the ways we only read about.
| Program | What it does | What we saw |
|---|---|---|
| 7-Zip | Free archiver that lists and copies files from many kinds | 14 of 18 disk images |
| Sleuth Kit | Command line tools that read forensic disk images, like fls and icat | 12 of 18 disk images |
| qemu-img and a mount | Converts a virtual disk to raw, then a loop mount shows the files | 10 of 10 virtual disks |
| bsdtar and xorriso | Unpack ISO files from the command line | All 4 ISO files |
| Mount-DiskImage | PowerShell on Windows, for ISO, VHD and VHDX files, says Microsoft | Not tested |
| Finder on a Mac | Mounts a DMG as a volume, says Wikipedia | Not tested |
Open disk images with 7-Zip
7-Zip reads the layers by itself. On our dynamic VHD, the list command showed the four test files, plus a 4,194,304-byte entry named [SYS]/Journal, which is the journal of the ext4 file system. One pass was enough for raw, VHD, VHDX, VMDK, VDI, QCOW2, ISO and UDF files. The gzip file took two.
7z l i03-vhd-dynamic.vhd
7z x i03-vhd-dynamic.vhd -oout
# a gzip file needs two passes
7z x i13-raw.img.gz -oout1
7z x out1/i13-raw.img -oout27-Zip stopped with exit code 2 on the stream VMDK, on both E01 files and on the BIN file. For those, use Sleuth Kit or convert the file first.
Open forensic disk images with Sleuth Kit
Sleuth Kit reads disk image files without a mount. The fls command lists files and the icat command copies one out by its number. Add -i with the image type, and -o with the start sector of the partition. Ours began at sector 2,048.
fls -i raw -o 2048 -r i01-raw.img
fls -i ewf -o 2048 -r -p i11-ewf.E01
fls -i raw -f iso9660 i15-iso-joliet-rr.iso
# copy one file out by its number
icat -i raw -o 2048 i01-raw.img 16 > photo.binfls -i raw -o 2048 -r i01-raw.img
d/d 11: lost+found
d/d 12: docs
+ r/r 13: report.txt
r/r 14: hello.txt
r/r 15: notes.txt
r/r 16: photo.binSleuth Kit was the only reader that opened the E01 disk images. It also read the stream VMDK. The command fls -i list shows its image types: raw, AFF, EWF, VMDK and VHD. It lists no VHDX, VDI or QCOW2 type, so we did not try those.
Open virtual disks with qemu-img and a mount
The qemu-img tool reads VHD, VHDX, VMDK, VDI and QCOW2 files. Convert the file to raw, then mount the partition read-only with an offset. We did this for all 10 virtual disks, and every one gave back all four files.
qemu-img info -f vpc i02-vhd-fixed.vhd
qemu-img convert -O raw i08-qcow2.qcow2 disk.raw
fdisk -l disk.raw
sudo mkdir -p /mnt/img
sudo mount -o loop,ro,offset=1048576 disk.raw /mnt/img
ls /mnt/img
sudo umount /mnt/imgPass -f with the format when you can. Without it, qemu-img info called our fixed VHD raw. The offset 1,048,576 is sector 2,048 times 512 bytes, and fdisk -l shows the start sector of your own partition.
Open ISO files
ISO files open with 7-Zip, bsdtar or xorriso, and Windows can mount them. Microsoft's Mount-DiskImage page says the command mounts ISO, VHD and VHDX files, and that ISO files always mount read-only. Wikipedia says Windows 7 and later can mount VHD files as drives through Disk Management.
7z x i15-iso-joliet-rr.iso -oout
bsdtar -x -f i15-iso-joliet-rr.iso -C out
xorriso -osirrox on -indev i15-iso-joliet-rr.iso -extract / outMount-DiskImage -ImagePath "C:\Images\disc.iso"
Mount-DiskImage -ImagePath "C:\Images\disk.vhdx" -Access ReadOnlyAll four of our ISO kinds returned the four files with all three tools. Level 1 names came back in upper case, like HELLO.TXT. The Joliet and Rock Ridge ISO kept lower case. We could not mount ISO or UDF files in our container, so the mount steps above come from Microsoft and not from our tests.
Free viewers and reference pages
These cards link to outside pages: two Windows viewers for DMG, E01 and DD files, the Microsoft mount page and the Wikipedia article on disk images.
SysTools Disk Image Viewer
Opens DMG, E01 and DD files on Windows
Freeviewer Disk Image Viewer
Opens DMG, E01 and DD files on Windows
Mount-DiskImage on Microsoft Learn
Mounts ISO, VHD and VHDX files
SysTools describes a Windows viewer that opens DMG, E01 and DD files, previews items and searches by file name or date range. Its page says the trial previews only, and the Pro version saves disk images and selected files. The page calls the viewer freeware in one place and describes a paid tier in another, so read the limits before you install. We did not test it.
Freeviewer describes a Windows viewer for DMG, E01 and DD files that shows file names, dates and sizes. It says the trial previews items only, and Pro adds search and saving. It needs the .NET Framework 4.0. Neither page names VHD, VMDK or ISO files, so use 7-Zip or qemu-img for those. We did not test this viewer either.
Both pages also mention email files found inside disk images. For those, see the PST file guide, the OST file guide and the EDB file guide.
A tip for Windows and Mac users. We tested on Linux only. For Mac installers, see the guide to DMG files. For Windows virtual disks, see the guides to VHD files and VDI files.
How Do You Make a Disk Image? dd, qemu-img, ewfacquire and genisoimage
Make raw disk images with dd, virtual disks with qemu-img convert, ISO files with genisoimage and E01 files with ewfacquire. Copy from unmounted drives, write to different drives and hash the result right away.
Making disk images means reading every sector of the source and saving the data in one layout. Our test disks came from mkfs.ext4 and qemu-img convert on 40 MiB files, and not from live drives. The commands below are the ones we used, apart from the dd line, which comes from our guide to the dd tool.
- Name the source drive and check its size. Use an unmounted drive, or mount it read-only, so no file changes during the copy.
- Copy it with dd for a raw disk image, or start from a raw disk image and convert it with qemu-img for virtual disks. Write the result to another drive.
- Hash the new disk image right away with sha256sum, and save the hash file in another place.
- Open the copy once and look at the files before you rely on it.
# a raw copy of a disk (see the DD guide)
sudo dd if=/dev/sdb of=disk.img bs=4M status=progress
# virtual disks from the raw image
qemu-img convert -f raw -O vpc -o subformat=fixed,force_size=on disk.img disk-fixed.vhd
qemu-img convert -f raw -O vpc -o subformat=dynamic,force_size=on disk.img disk-dynamic.vhd
qemu-img convert -f raw -O vhdx disk.img disk.vhdx
qemu-img convert -f raw -O vmdk -o subformat=monolithicSparse disk.img disk.vmdk
qemu-img convert -f raw -O vdi disk.img disk.vdi
qemu-img convert -f raw -O qcow2 -c disk.img disk.qcow2
# an E01 file
ewfacquire -u -t disk -c deflate:fast -f encase6 disk.img
# an ISO file from a folder
genisoimage -V DISKTEST -J -R -o disc.iso folder| Tool | Makes | What we saw |
|---|---|---|
| qemu-img convert | VHD, VHDX, VMDK, VDI and QCOW2 | Nine virtual disk files from one raw disk image. All nine converted back to raw with the same SHA-256 hash. |
| genisoimage | ISO 9660 | Level 1, Joliet and Rock Ridge, UDF and bootable ISO files from one folder |
| ewfacquire | E01 | Two E01 files, one raw and one deflate. The stored MD5 hash matched the data. |
| gzip | Gzipped raw disk images | From 41,943,040 down to 242,213, in bytes |
Mind the size of a VHD
Without the option force_size=on, qemu-img rounded our VHD sizes up. The dynamic VHD read back as 41,953,280 bytes, which is 10,240 bytes more than the raw source, so its hash did not match. A fixed VHD made that way was 41,953,792 bytes. With the option, every VHD we made matched the source.
qemu-img convert -f raw -O vpc -o subformat=dynamic,force_size=on disk.img disk.vhdFailing drives
Wikipedia on failing drives notes that Unix tools like dd are not built to handle read failures, and that ddrescue is the tool it recommends for recovery. We tested neither on a failing drive. Our drives were files, and they never failed.
Write to a different drive. Never save a disk image on the drive you are copying. The copy then changes the source while it reads, and full drives stop the job part way.
How Do You Check a Disk Image Is Sound? sha256sum, ewfverify and qemu-img check
Check disk images with hashes. Use sha256sum for any file, ewfverify for E01 files and qemu-img check for QCOW2, VDI, VHDX and VMDK files. In our tests, only a hash or ewfverify found flipped bytes, and qemu-img check found the cut QCOW2 file.
Hashes are short fingerprints of files. Change one byte and the fingerprint changes. Make one when you create the disk image, and compare it before you use copies. The check shows whether copies match the file you hashed. It cannot show that the first copy was good.
- Hash the disk image as soon as you make it, and save the hash file away from the disk image.
- Before you use a copy, check it against the saved hash with sha256sum -c.
- For an E01 file, use ewfverify. It compares the MD5 hash stored in the file with the data.
- For QCOW2, VDI, VHDX and VMDK files, use qemu-img check to look at the inside tables.
sha256sum disk.img > disk.img.sha256
sha256sum -c disk.img.sha256
# E01 files
ewfverify disk.E01
# QCOW2, VDI, VHDX and VMDK files
qemu-img check disk.qcow2
# a virtual disk and its raw twin share one data hash
qemu-img convert -f qcow2 -O raw disk.qcow2 check.raw
sha256sum check.rawewfverify d10-e01-flipped-byte.E01
Sector validation errors:
total number: 1
at sector(s): 9728 - 9791 (number: 64)
MD5 hash stored in file: c8b3f4229d792fae864013958b6133aa
MD5 hash calculated over data: 16a07ecad76e49064fd0ef2de088f4fa
ewfverify: FAILURE| Check | What we found |
|---|---|
| sha256sum on a raw disk image with one flipped byte | A different hash from the original. Three readers had opened it with no error. |
| ewfverify on the good E01 files | SUCCESS. The stored MD5 hash matched the data. |
| ewfverify on three flipped E01 files | FAILURE for all three, and every one named a range of 64 sectors. |
| qemu-img check on good files | No errors for the QCOW2, VDI, VHDX and VMDK files. It does not check VHD files. |
| qemu-img check on the cut QCOW2 file | Errors about regions past the end of the file. |
| ewfrecover on a flipped E01 file | It said the EWF files are not corrupted, and it repaired nothing. |
The ewfverify result shows why the second hash matters. The MD5 hash stored in the file was the right one for the disk. ewfverify calculated a different one from the damaged data, and the two disagreed. The SHA-256 field stored in our files read N/A, so keep your own SHA-256 file for E01 files too.
Which hash to use
MD5 finds accidents, but it is weak against a deliberate change. For a disk image you download, use the SHA-256 hash from the download page. For one you make, use sha256sum and keep the file away from the disk image.
Compare the same thing. The hash of a QCOW2 file is not the hash of the disk inside it. Convert virtual disks to raw and hash that, if you want to compare with raw copies.
Why Will Your Disk Image Not Open? Twenty damage tests, and fixes that took a few bytes
Disk images that will not open usually have a damaged signature, footer or side file. In our 20 damaged cases, a reader returned all four files from 7 as they were and from 6 more after one small repair. Seven stayed incomplete.
We broke copies of the good disk images in 20 ways and tried the readers before and after a repair. The chart shows what the readers could do. Green means all 4 test files came back byte for byte, amber means some did and red means none did.
| Damage | What you see | Fix |
|---|---|---|
| Fixed VHD: footer zeroed | qemu-img said invalid VPC image. 7-Zip still read it as a raw disk. | Rebuild the footer |
| Dynamic VHD: end footer zeroed | Sleuth Kit and 7-Zip failed. qemu-img still read it. | Copy the start footer to the end |
| Dynamic VHD: start copy zeroed | qemu-img said invalid VPC image. Sleuth Kit still read it. | Copy the end footer to the start |
| VHDX: signature zeroed | qemu-img could not open it, and 7-Zip stopped with exit code 2. | Write vhdxfile at byte 0 |
| VMDK: magic zeroed | qemu-img said invalid VMDK image descriptor. | Write KDMV at byte 0 |
| Split VMDK: extent renamed | qemu-img could not open the extent file the descriptor names. | Name the extent the way the descriptor says |
| VDI: signature zeroed | qemu-img said Image not in VDI format (bad signature 00000000). | Write 7f 10 da be at byte 64 |
| QCOW2: magic zeroed | qemu-img said Image is not in qcow2 format. | Write QFI and fb at byte 0 |
| BIN with the wrong mode in the CUE file | bsdtar found no archive format. 7-Zip stopped with exit code 2. | Set MODE1/2352 and use bchunk |
| Wrong ending on raw images or QCOW2 files | Nothing. 7-Zip, Sleuth Kit and qemu-img read them anyway. | Rename the file |
The repairs, in small byte patches
Every repair writes some bytes back or copies the footer. Always work on a copy. The option conv=notrunc matters. Without it, dd cuts the file after the bytes it writes and destroys the rest. Four of these repairs gave files identical to the original, byte for byte: the VHDX, VMDK, VDI and QCOW2 signatures. The two dynamic VHD footer copies did too.
printf 'vhdxfile' | dd of=broken.vhdx bs=1 conv=notrunc
printf 'KDMV' | dd of=broken.vmdk bs=1 conv=notrunc
printf '\x7f\x10\xda\xbe' | dd of=broken.vdi bs=1 seek=64 conv=notrunc
printf 'QFI\xfb' | dd of=broken.qcow2 bs=1 conv=notrunc# fixed VHD, footer gone: keep the disk bytes and make a new footer
head -c $(( $(stat -c %s broken.vhd) - 512 )) broken.vhd > disk.raw
qemu-img convert -f raw -O vpc -o subformat=fixed,force_size=on disk.raw fixed.vhd
# dynamic VHD, end footer gone: copy the start footer to the end
head -c 512 broken.vhd | dd of=broken.vhd bs=512 seek=$(( $(stat -c %s broken.vhd) / 512 - 1 )) conv=notrunc
# dynamic VHD, start copy gone: copy the end footer to the start
tail -c 512 broken.vhd | dd of=broken.vhd bs=512 conv=notruncThe fixed VHD is the odd one. A new footer gets a new date and ID. The repaired file has the same size as the original and contains the same disk, but it is not identical byte for byte. The split VMDK needs no byte edit. Give the extent file the name its descriptor lists.
VMDK files keep one more trap. A single-file VMDK stores its own descriptor, and that descriptor names the file. When we renamed the repaired copy, Sleuth Kit failed to open it. Our repaired copy worked only under its original name.
A BIN file with the wrong CUE mode
A CUE file names the BIN file and gives its mode. Ours said MODE1/2048, but the BIN file had 2,352-byte sectors, so 7-Zip, bsdtar and xorriso all failed. After we set the mode to MODE1/2352, bchunk wrote an ISO file, and all four ISO tools read it.
FILE "disc.bin" BINARY
TRACK 01 MODE1/2352
INDEX 01 00:00:00bchunk disc.bin disc.cue out_
ls out_*.isoWhat the tools could not fix
Downloads cause some of these. Transfers that stop part way give cut disk images, like our QCOW2 and ISO cases. Download again and compare the hash with the one on the page. Repairs cannot bring back bytes that the copy never had.
Compare before you celebrate. After repairs, list the files and compare them with hashes, if you have them. A disk image that opens is not always a disk image that matches the original.
How Do You Convert a Disk Image to Another Format? qemu-img, ewfexport, gunzip and bchunk, checked with a hash
Convert virtual disks with qemu-img convert, E01 files with ewfexport, gzip files with gunzip and BIN files with bchunk. In our round trips, every one converted back to raw with the same SHA-256 hash as the start. We named the format and added force_size=on for VHD files.
Converting a disk image reads the disk inside it and writes it again in another layout. A good conversion keeps the disk bytes the same, so the hash of the raw output should match the hash of the raw source. We checked that for every route.
| Route | What we saw |
|---|---|
| qemu-img convert to raw | All 9 virtual disks gave the same SHA-256 hash as the raw disk image we started from. |
| qemu-img convert to VHD without force_size | The size grew by 10,240 bytes for a dynamic VHD, so the hash changed. |
| ewfexport from E01 to raw | The same hash, 41,943,040 bytes. |
| gunzip of the gzip file | The same hash. |
| bchunk from BIN and CUE to ISO | An ISO file with the same SHA-256 hash as the Joliet ISO we built the BIN file from. |
qemu-img convert -f qcow2 -O raw i08-qcow2.qcow2 disk.raw
qemu-img convert -f vpc -O raw i03-vhd-dynamic.vhd disk.raw
ewfexport -u -t disk -f raw -o 0 i11-ewf.E01
gunzip -c i13-raw.img.gz > disk.raw
bchunk i18-disc.bin i18-disc.cue out_
sha256sum disk.rawMind the format name
Name the input format with -f. Without it, qemu-img looked at our fixed VHD and called it raw, because the file is a raw disk image plus a footer. The size it printed was 512 bytes too large. With -f vpc, it printed 41,943,040 bytes.
Convert the descriptor, not the extent
For a split VMDK, give qemu-img the small descriptor file and keep the extent files beside it. The descriptor names the extents, and the tool follows those names. Our split VMDK converted back to raw with the same hash.
A converter converts, and a hash proves it
Routes that finish without errors have not proved that the disk image came across. Hash the raw output, and compare it with the hash of the raw source. For E01 files, ewfverify adds a second check. Our stored SHA-256 field read N/A, so it could not help with that one.
Raw output is large. A raw disk image is as big as the disk, even when the disk is empty. Our 40 MiB disk made a 41,943,040-byte file every time. Compress it with gzip if you need to keep it.
Which Disk Image Format Should You Choose? By purpose: evidence, virtual machine, disc or installer
Choose the format by what the disk image is for. Use raw or E01 for evidence, VHDX or QCOW2 for virtual machines, ISO for discs and DMG for Mac installers. Our tests show size and reader support, and they do not show speed.
There is no best disk image format. Every format grew up around a product. The table lists the purposes we found in our sources, and it adds what our own tests showed. We did not measure speed, memory or how every format behaves under heavy use.
| Purpose | Format | Why, and where it comes from |
|---|---|---|
| A forensic copy | Raw or E01 | Wikipedia links raw disk images to forensic use. Our E01 files stored a hash, and ewfverify found all three flipped bytes. |
| A Hyper-V machine | VHD or VHDX | Wikipedia says VHDX is the native Hyper-V format and reaches 64 TB. A VHD tops out at 2,040 GB. |
| A VMware machine | VMDK | Made by VMware, and an open format since 2011, says Wikipedia. |
| A VirtualBox machine | VDI | Wikipedia names VDI as the Oracle VirtualBox format. |
| A QEMU machine | QCOW2 | Grows as data is written and supports compression and backing files, says Wikipedia. |
| A disc or an installer | ISO | The ISO 9660 standard. All four of our ISO kinds were read by 7-Zip, Sleuth Kit, bsdtar and xorriso. |
| A Mac installer | DMG | Wikipedia says it is mostly used to distribute software on macOS. We did not test it. |
| The smallest file | Raw plus gzip | Our gzip file was 242,213 bytes, the smallest of the set. You must unpack it first. |
| The most readers | Raw | Our raw disk image was read by 7-Zip, Sleuth Kit and the qemu-img route. |
For backups you plan to keep, two more rules matter more than the format. Hash the disk image when you make it, and test restores before you need them. Formats that no tool can open next year are a risk that hashes do not solve.
Sources only. The purposes above come from Wikipedia and Microsoft pages. Our own tests cover only the sizes and the readers.
What Else Uses a Disk Image Ending? .img, .bin, .mdf and endings that mislead
Endings like .img, .bin and .iso are only names. In our tests, raw disk images named .vhd and QCOW2 files named .iso both opened once we ignored the name. Read the bytes before you choose a program.
FileInfo's list of disk image endings goes far past the ones we tested. The table shows a few of its entries, with the short description it gives.
| Ending | FileInfo description | Our note |
|---|---|---|
| .iso | Generic disk image | Tested, as ISO 9660 and UDF |
| .img | Disc image data file | A raw disk copy in our tests |
| .mdf | Media descriptor file | Not tested |
| .mds | Media descriptor sidecar file | Not tested |
| .cso | Compressed ISO image | Not tested |
| .ex01 | EnCase evidence image | Not tested. We built E01 files only. |
| .hdi | Hard disk image | Not tested |
| .rom | Read-only memory image | Not tested |
| .d64 | Commodore 64 1541 disk image | Not tested |
Endings that mislead
We saved a raw disk image with a .vhd ending and a QCOW2 file with an .iso ending. Programs that read the bytes did not care. 7-Zip opened both, Sleuth Kit opened the raw disk image and qemu-img opened both when we named the format. Programs that trust the ending would be fooled by both.
Side files
Some disk images of discs come in pairs of files. Our BIN file needed a CUE text file to name its mode, and a wrong mode made every tool fail. FileInfo on MDS files lists .mds as the sidecar file of .mdf. We did not test MDF and MDS files, but the MDF file guide covers that format.
Floppy and old disk images
Floppy disk images use endings like .ima, and the IMA file guide covers them. We built no floppy disk images. FileInfo also lists the .d64 ending for Commodore 64 disks, which shows how far the word disk image reaches.
What Are Disk Image Formats Made Of? The facts we could check, and what we left out
Disk image formats are not one standard. These are the facts we could check against Wikipedia, Microsoft, FileInfo and our own 38 test disk images, plus the points we left out.
| Format | What we could check |
|---|---|
| ISO 9660 | A disc standard from 1988, also called ECMA-119, with 2,048-byte sectors. The text CD001 starts at byte 32,769. Tested with four kinds. |
| UDF | The disc format used on DVDs, says Wikipedia. Our UDF ISO opened in 7-Zip, Sleuth Kit, bsdtar and xorriso. |
| DMG | Apple's UDIF format. The metadata is in a 512-byte trailer at the end, and Apple has not published the format, says Wikipedia. Not tested. |
| VHD | Made by Connectix and kept by Microsoft. Fixed, dynamic and differencing types. The text conectix. Tested fixed and dynamic. |
| VHDX | The newer Microsoft format, up to 64 TB, says Wikipedia. Starts with the text vhdxfile. Tested. |
| VMDK | Made by VMware. A descriptor lists extents, and the data is in the extents. Tested sparse, stream and split files. |
| VDI |
The VirtualBox format. The text <<< at the start and 7f 10 da be at byte 64. Ours came from QEMU.
|
| QCOW2 |
The QEMU format. Starts with 51 46 49 fb. Tested with and without zlib compression.
|
| E01 | The EnCase evidence format. Starts with EVF. Our files cut the disk into pieces of 64 sectors and stored an MD5 hash. |
| Raw (.img) |
No header. The first sector ends with 55 aa on an MBR disk. Tested.
|
| BIN and CUE | Sectors of 2,352 bytes plus a text sheet. Ours was a synthetic BIN made from an ISO. |
| MDF and MDS | Listed by FileInfo as a media descriptor file and its sidecar. Not tested. |
About the values we list
The signatures and byte positions come from our own disk images, made on Ubuntu 24.04 with qemu-img 8.2.2, ewfacquire, genisoimage and mkfs.ext4 in October 2026. Other versions may write other headers. Our VDI came from QEMU, so VirtualBox may write different text at the start.
What we left out
We did not test DMG, NRG, MDF and MDS, CSO or Toast images, encrypted disk images, disk images over 40 MiB or discs from a physical drive. We did not test any Windows or macOS tool. Our container had no ISO or UDF driver, so we did not mount ISO files.
The SysTools and Freeviewer viewers in the open section come from their own pages, and we did not start either one. We name no prices. What we say about DMG, VHDX limits and VMware comes from Wikipedia, and what we say about Mount-DiskImage comes from Microsoft.
Our damage tests are simple breaks in small disk images. We tried four kinds of reader, and others may behave differently. file(1) printed AES-encrypted for our QCOW2 files, but qemu-img showed no encryption, so we trusted qemu-img.
Sources checked
For the idea and the uses, see the Wikipedia article on disk images and the FileInfo list of disk image endings. For formats, see the Wikipedia pages on ISO 9660, Apple Disk Image, VHD, VMDK and QCOW. For Windows, see the Microsoft pages on Mount-DiskImage and the VHD overview.
Every test count came from the 38 disk images and the scripts in our research folder.
Frequently Asked Questions About Disk Images
What is a disk image?
A disk image is a file that stores a full copy of a disk, disc or drive, with its partition table and file system. Backups, virtual machines, forensic cases and software installers use disk images. Some kinds copy every byte, and others store only the used blocks. FileInfo lists many endings for them, from .iso and .dmg to .vdi, .vmdk and .vhd.
How do I open a disk image?
Use 7-Zip to list and copy files, use Sleuth Kit for forensic disk images or mount the disk image like a drive. In our test, 7-Zip opened 14 of 18 good disk images, Sleuth Kit 12 and qemu-img with a mount 10. No single reader opened them all, so match the reader to the kind. Read the first bytes to find the kind.
How do I find out which kind of disk image I have?
Read three places: the first 8 bytes, the 5 bytes at byte 32,769 and the last 512 bytes. Names like conectix, vhdxfile, KDMV or QFI at byte 0 mark virtual disks, and the text CD001 at byte 32,769 means an ISO file. Fixed VHD and DMG files name themselves in the last 512 bytes. Raw disk images have no name, only 55 aa at bytes 510 and 511.
How do I open an ISO file?
Open the ISO file with 7-Zip, bsdtar or xorriso, or mount it. Microsoft says Mount-DiskImage mounts ISO files on Windows, always read-only. In our test, all four ISO kinds returned the four files with all three tools. We could not test mounts, because our container had no ISO driver.
How do I open a VHD, VMDK or QCOW2 file?
Use 7-Zip, or convert the disk image to raw with qemu-img and mount it. 7-Zip opened our VHD, VHDX, VMDK, VDI and QCOW2 files in one pass, except the stream VMDK. The qemu-img route opened all 10 virtual disks. Name the format with -f, because qemu-img called our fixed VHD raw without it.
How do I make a disk image?
Use dd for raw copies, qemu-img convert for virtual disks, genisoimage for ISO files and ewfacquire for E01 files. Copy from unmounted drives and save the disk image on a different drive. Add force_size=on when you make VHD files, or the size grows. Hash the result right away.
How do I check that a disk image is not damaged?
Hash the disk image with sha256sum when you make it, and compare the hash before you use copies. For E01 files, ewfverify compares the stored MD5 hash with the data. For QCOW2, VDI, VHDX and VMDK files, qemu-img check looks at the inside tables. In our test, only a hash or ewfverify found flipped bytes in raw or E01 files.
Why will my disk image not open?
The usual causes are damaged signatures or footers, renamed side files, wrong CUE modes and cut downloads. In our 20 damaged disk images, readers returned all four files from 7 as they were and from 6 more after one small repair. Seven stayed incomplete. A zeroed signature took only some bytes to fix, while cut files need new downloads.
Can I convert a disk image to another format?
Yes. Use qemu-img convert for virtual disks, ewfexport for E01 files, gunzip for gzip files and bchunk for BIN and CUE files. In our round trips, all nine virtual disks, an E01 file and a gzip file converted back to raw with the same SHA-256 hash as the start. The BIN file converted to an ISO file with the same hash as the ISO we made it from.
Is a disk image the same as an ISO file?
No. An ISO file is one kind of disk image: a copy of an optical disc in 2,048-byte sectors. Other disk images copy hard disks, USB drives or virtual machine disks, and they use formats like raw, VHD, VMDK and QCOW2. The ending alone does not show which one you have.
What is the difference between a raw disk image and a VHD or VMDK?
Raw disk images copy every byte with no header, so 40 MiB disks make 40 MiB files. VHD, VMDK, VDI and QCOW2 files add headers and block maps, so they can grow as needed or compress. Our 40 MiB test disk made files from 242,213 bytes to 41,961,855 bytes, depending on the format.
Is there a free viewer for DMG, E01 and DD disk images?
SysTools and Freeviewer both describe a Windows viewer for DMG, E01 and DD disk images. Both say the trial previews items only, and the paid Pro version saves them. We did not test either one, so read the limits on their pages first. For other kinds, use 7-Zip or qemu-img.
Still Stuck With a Disk Image? Eight routes out, depending on what went wrong
Start with the damage grid. Wiped signatures, missing footers or wrong CUE modes explain many cases, and small byte edits fix them.
Go to how to hash disk images. A hash made at the start is the only check that catches a flipped byte.
Is it a raw copy of a disk? The DD disk image guide explains the dd tool and the raw format.
Is it a Mac installer? The DMG disk image guide explains the Mac format.
Is it forensic evidence? The E01 evidence file guide explains the EnCase format.
Is it a virtual machine disk? See the VMDK virtual disk guide, the VHD virtual disk guide or the VDI virtual disk guide.
Is it a disc image with a side file? The MDF disc image guide explains one common pair.
Is it a file type you do not know? Browse the file extension resource library, or send it to us on the submit a file type page.