What Is an IMA File? A Raw Floppy Disk Image, and How to Check One Before You Trust It

7 How Do You Open an IMA File? Archive tools, mtools, Sleuth Kit, Python and emulators

Opening an IMA file means one of two things. You can read it to see the files inside, or you can boot it to start the disk in an emulator. Reading changes nothing in the file. Booting starts the code in its first sector, so use a copy.

Open an IMA file with 7-Zip

7-Zip 23.01 opens FAT disk images like archives, and it names the type as FAT. The FileInfo page lists WinImage, Nero, UltraISO, IsoBuster and MagicISO for an IMA file that is a disk image. We tested none of those five.

7z l base.ima
   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2026-10-25 07:32:08 D....                            DOCS
2026-10-25 07:32:08 ....A           34          512  README.TXT
2026-10-25 07:32:08 ....A           46          512  NOTES.TXT
2026-10-25 07:32:08 ....A       200000       200192  PHOTO.BIN
2026-10-25 07:32:08 ....A           27          512  Quarterly report.txt
2026-10-25 07:32:08 ....A         1160         1536  DOCS/REPORT.TXT
------------------- ----- ------------ ------------  ------------------------
2026-10-25 07:32:08             201267       203264  5 files, 1 folders

To save the files, use 7z x base.ima -oout. 7-Zip is also the only reader that opened our zipped, gzipped and prefixed IMA files, because it has a step that unwraps them on the way in. The damaged copies part lists them.

Copy files out with mtools

mtools is a toolset for DOS disks, and it reads an IMA file without a mount or a driver. It names the image with -i and the root of the disk with two colons. The first command below lists every folder, and the second copies every file out.

mdir -s -i base.ima ::
mcopy -s -n -i base.ima :: out/

The listing is the one we showed in the inside part. mtools refused 18 of our 50 damaged IMA files, and it gave a different answer with no warning on 17, so check its count against a second reader.

List files with Sleuth Kit

The Sleuth Kit is a set of forensics tools for a disk or an IMA file. fls lists files, folders and deleted names. icat saves one file by its number. Lines that start with v are virtual files that show the boot sector and the two FATs.

fls -r -p base.ima
r/r 3:	IMATEST     (Volume Label Entry)
d/d 4:	DOCS
r/r 229:	DOCS/REPORT.TXT
r/r 5:	README.TXT
r/r 6:	NOTES.TXT
r/r 7:	PHOTO.BIN
r/r 10:	Quarterly report.txt
v/v 45779:	$MBR
v/v 45780:	$FAT1
v/v 45781:	$FAT2
V/V 45782:	$OrphanFiles
icat base.ima 7 > PHOTO.BIN

Read an IMA file in Python

pyfatfs is a Python library that reads FAT disks. A short program below lists every file with its size, and it opened base.ima with no warning. It warned or refused on 29 of the 50 damaged IMA files.

from pyfatfs.PyFatFS import PyFatFS
fs = PyFatFS('base.ima', read_only=True)
for path in fs.walk.files():
    print(path, len(fs.readbytes(path)))
fs.close()
# prints
/README.TXT 34
/NOTES.TXT 46
/PHOTO.BIN 200000
/Quarterly report.txt 27
/DOCS/REPORT.TXT 1160

Check an IMA file with fsck.fat

fsck.fat is the disk checker from dosfstools. With the -n flag it reads an IMA file and changes nothing. It is a checker, not a file saver. It counts 7 files here where the listing shows 5 files and a folder, so we used its warnings and its cluster count and not its file count.

fsck.fat -n base.ima
fsck.fat 4.2 (2021-01-31)
base.ima: 7 files, 398/2847 clusters

Mount an IMA file on Linux

A mount shows the disk as a folder. The usual command is below. Our test machine had no vfat support in its kernel, so we could not try it, and we do not claim it works for your IMA file. The ro option keeps the image unchanged.

sudo mount -o loop,ro -t vfat base.ima /mnt/floppy

Boot an IMA file in an emulator

An emulator starts the image as a floppy disk. QEMU documents its -fda option, which uses a file as the floppy disk image. The DOSBox-X wiki guide says that DOSBox-X treats the .IMA ending as a diskette image. We used no emulator.

8 How Do You Check an IMA File? Six steps, and only the last one reads file bytes

The six steps

1. 1 Copy the IMA file, write down its SHA256 hash and work on the copy.
2. 2 Read the size and compare it with the size table. Sizes a few sectors off mean cut or padded IMA files.
3. 3 Read the first 64 bytes with xxd -l 64. Look for EB or E9 first and 55 AA at byte 510. A file with neither can be wrapped, or it can be another kind of file.
4. 4 Read the boot sector fields from the table. Bytes per sector, sectors per cluster and total sectors should fit the size of the file.
5. 5 Follow the FATs and folders with the script below. It reports FAT copies that differ and chains that do not fit the file sizes.
6. 6 Open the IMA file with a second reader, like mtools or 7-Zip, and compare the count and the bytes. Open one file inside and read it.

A 73 line script that reads the IMA file

The Python script below does steps 3 to 5 in one second. It reads the boot sector and works out the FAT type from the number of clusters. It compares the two FATs, and it follows the chain of every file. It prints REFUSED when it cannot go on, and a note for every smaller worry.

import sys

def u(b, o, n): return int.from_bytes(b[o:o + n], 'little')

def peek(path):
    d = open(path, 'rb').read()
    notes = []
    if len(d) < 512: return ['REFUSED: shorter than one sector (%d bytes)' % len(d)]
    bps, spc, rsv, nf, root = u(d, 11, 2), d[13], u(d, 14, 2), d[16], u(d, 17, 2)
    tot = u(d, 19, 2) or u(d, 32, 4)
    media, spf, spt, hd = d[21], u(d, 22, 2), u(d, 24, 2), u(d, 26, 2)
    if d[510:512] != b'\x55\xaa': notes.append('no 55 AA at byte 510')
    if (bps not in (512, 1024, 2048, 4096) or spc not in (1, 2, 4, 8, 16, 32, 64, 128)
            or not 1 <= nf <= 2 or not rsv or not spf or not root or not tot):
        return notes + ['REFUSED: the boot sector has no usable FAT12 or FAT16 fields']
    rs = (root * 32 + bps - 1) // bps
    first = rsv + nf * spf + rs
    clusters = (tot - first) // spc
    kind = 'FAT12' if clusters < 4085 else 'FAT16' if clusters < 65525 else 'FAT32'
    print('%s: %s bytes, %s, %d clusters of %d bytes, media 0x%02X, %d heads, '
          '%d sectors per track' % (path, format(len(d), ','), kind, clusters, spc * bps, media, hd, spt))
    if kind != 'FAT12': return notes + ['REFUSED: this script reads FAT12 only']
    if len(d) != tot * bps:
        notes.append('file is %+d bytes against the %d the boot sector claims'
                     % (len(d) - tot * bps, tot * bps))
    f1 = d[rsv * bps:(rsv + spf) * bps]
    f2 = d[(rsv + spf) * bps:(rsv + 2 * spf) * bps]
    if len(f1) < spf * bps: return notes + ['REFUSED: the file ends inside the first FAT']
    if f1[0] != media: notes.append('media byte 0x%02X differs from the FAT byte 0x%02X' % (media, f1[0]))
    if nf == 2 and f1 != f2: notes.append('the two FAT copies differ')
    def nxt(c):
        v = u(f1, c * 3 // 2, 2)
        return v >> 4 if c & 1 else v & 0xFFF
    def chain(c):
        out = []
        while 2 <= c < 0xFF0 and c <= clusters + 1 and c not in out:
            out.append(c)
            c = nxt(c)
        return out, c
    def sector(c): return d[(first + (c - 2) * spc) * bps:(first + (c - 1) * spc) * bps]
    def walk(buf, name):
        files = size = 0
        for i in range(0, len(buf), 32):
            e = buf[i:i + 32]
            if e[0] == 0: break
            if e[0] == 0xE5 or e[11] & 0x08 or e[11] & 0x0F == 0x0F: continue
            n, cl, sz = e[:8].decode('latin1').strip(), u(e, 26, 2), u(e, 28, 4)
            if e[11] & 0x10:
                if n in ('.', '..'): continue
                ch, end = chain(cl)
                sub = b''.join(sector(c) for c in ch)
                if not ch:
                    notes.append('folder %s/%s has no clusters' % (name, n))
                    continue
                a, b = walk(sub, name + '/' + n)
                files += a
                size += b
            else:
                ch, end = chain(cl)
                need = -(-sz // (spc * bps))
                if len(ch) != need or (sz and end < 0xFF8):
                    notes.append('%s/%s: %d clusters for %d bytes, chain ends 0x%03X'
                                 % (name, n, len(ch), sz, end))
                files += 1
                size += sz
        return files, size
    rootbuf = d[(rsv + nf * spf) * bps:first * bps]
    files, size = walk(rootbuf, '')
    print('%d files, %s bytes of file data' % (files, format(size, ',')))
    return notes or ['no complaint']

for p in sys.argv[1:]:
    for line in peek(p): print(line)

On the intact file it finds 5 files and 201,267 bytes, and it has no complaint. On damaged IMA files it names the problem. B8 has a chain that ends early, E1 is 512 bytes short and A9 has a total of zero sectors. F1 has 512 bytes in front, so it has no 55 AA.

python3 ima_peek.py base.ima
base.ima: 1,474,560 bytes, FAT12, 2847 clusters of 512 bytes, media 0xF0, 2 heads, 18 sectors per track
5 files, 201,267 bytes of file data
no complaint
python3 ima_peek.py B8.ima E1.ima A9.ima F1.ima
B8.ima: 1,474,560 bytes, FAT12, 2847 clusters of 512 bytes, media 0xF0, 2 heads, 18 sectors per track
5 files, 201,267 bytes of file data
/PHOTO: 10 clusters for 200000 bytes, chain ends 0xFFF
E1.ima: 1,474,048 bytes, FAT12, 2847 clusters of 512 bytes, media 0xF0, 2 heads, 18 sectors per track
5 files, 201,267 bytes of file data
file is -512 bytes against the 1474560 the boot sector claims
REFUSED: the boot sector has no usable FAT12 or FAT16 fields
no 55 AA at byte 510
REFUSED: the boot sector has no usable FAT12 or FAT16 fields

What the script cannot see

The script reads structure and not a single file byte. It passed all five damaged IMA files where we changed bytes inside files (D1, D2, D3, D5 and D6). It also read FAT12 only, so it refused the FAT16 and FAT32 images that four other readers opened.

Passes from our script are no promise. With the root folder zeroed (C1) it printed 0 files and no complaint. Refusals are reasons to look closer, not verdicts. It refused the FAT16 and FAT32 images, which were fine.

Want the causes of an error? Go to the causes.

9 Is an IMA File Safe to Open? Reading is safe, and booting starts the first sector

IMA files are copies of the bytes of disks. Reading one with a tool starts no program, and a read leaves a file as it was. We scanned no IMA file for malware, so we cannot speak for files from unknown senders. The ending proves nothing, because the file command calls our IMA file a DOS boot sector.

file -b base.ima | sed 's/, /\n/g'
DOS/MBR boot sector
code offset 0x3c+2
OEM-ID "MTOO4043"
root entries 224
sectors 2880 (volumes <=32 MB)
sectors/FAT 9
sectors/track 18
serial number 0x2dad1bae
label: "IMATEST    "
FAT (12 bit)
followed by FAT

What booting does

Wikipedia on the boot sector says the BIOS loads the first sector of a bootable floppy and starts it. It adds that the bytes 55 AA conventionally mark a boot loader. An emulator that boots your IMA file starts that code.

So boot only a copy, and set the disk read only where the emulator allows it. Guests can write to the image they started from. Reading IMA files with 7-Zip, mtools or Sleuth Kit never starts the first sector.

What the files can do

11 How Do You Convert or Make an IMA File? Four formats, and what they do to the size

Converting IMA files differs from opening them. A rename changes the name and no byte. Every other change on this page adds a wrapper or changes the size of the IMA file, so we tested all of them and compared the result with the source.

Make a new IMA file

GNU mtools makes blank floppy images with mformat. The command below made base.ima, and the size follows the number after -f. It gives a blank disk. The Unix dd program can make raw copies of physical disks too, per Wikipedia on raw images.

mformat -C -f 1440 -v IMATEST -i base.ima ::
mcopy -i base.ima README.TXT ::

IMA to IMG

Rename the IMA file. The hash of a.img was the same as the hash of a.ima, bit for bit. The ending .img also names other kinds of images, so check the first bytes of a file that comes with that name.

IMA to IMZ

Zip the IMA file with any zip tool. Our 1,474,560 byte image made 203,378 bytes of zip, and blank 1.44 MB images made 2,213 bytes. The zip unpacked to a file with the same bytes. Wikipedia on IMG names this format and WinImage as a maker.

7z a -tzip a.imz a.ima

IMA to ISO

ISO files are CD images, so the floppy image goes inside as a boot image. We used genisoimage with the -b option. The result was a file of 1,835,008 bytes. The file command called it bootable, and 7-Zip showed the image as a 1.44 MB boot image.

genisoimage -quiet -o a.iso -b a.ima iso/

IMA to VHD

qemu-img wrote VHD files of 2,100,224 bytes, with virtual disks of 1,497,088 bytes. That is 22,528 bytes more than the IMA file, because the tool rounds a disk up to its own cylinder, head and sector counts. Wikipedia on VHD gives the format and its maker.

Converting the VHD back gave an image of 1,497,088 bytes with another hash. All five files still read, and our script gave a note on the extra bytes. If you need the original IMA file size, cut the image back to 1,474,560 bytes.

qemu-img convert -f raw -O vpc a.ima a.vhd
qemu-img convert -f vpc -O raw a.vhd back.ima