Skip to main content

​
Forensic Disk Image Formats

IPED uses the Sleuthkit Library to decode disk images and file systems, with additional support for proprietary formats.

​
Disk Image Types

FormatExtensionsDescriptionSplitting Support
RAW/DD.dd, .raw, .imgRaw disk dump formatSingle and split segments
E01.e01, .e02, …EnCase Evidence File FormatSingle and split segments
EX01.ex01Expert Witness Extended FormatSingle and split segments
VHD.vhdVirtual Hard Disk (Microsoft)Single segment
VHDX.vhdxVirtual Hard Disk v2 (Microsoft)Single segment
VMDK.vmdkVirtual Machine Disk (VMware)Single segment and differentials
AFF.aff, .afdAdvanced Forensic FormatSupported
ISO9660.isoISO disk imageSingle segment
UDF.iso, .udfUniversal Disk FormatSupported
AD1.ad1AccessData Logical ImageSupported
UFDR.ufdrCellebrite Universal Forensic Data ReportSupported
Embedded Disk Processing: IPED can process supported disk images contained within the main evidence recursively when processEmbeddedDisks = true is enabled. Note that splitted images and snapshots are not currently supported for embedded processing.

​
File System Support

Through Sleuthkit integration, IPED supports:
  • NTFS - New Technology File System (Windows)
  • FAT12/FAT16/FAT32 - File Allocation Table
  • exFAT - Extended File Allocation Table
  • Ext2/Ext3/Ext4 - Extended File System (Linux)
  • HFS+ - Hierarchical File System Plus (macOS)
  • APFS - Apple File System (macOS/iOS)
  • ISO9660/UDF - Optical disc file systems
  • LVM - Logical Volume Manager (Linux)

​
Document Formats

​
Microsoft Office

FormatExtensionsParsingOCR Support
Word Documents.doc, .docx, .docmFullYes
Excel Spreadsheets.xls, .xlsx, .xlsmFullYes
PowerPoint Presentations.ppt, .pptx, .pptmFullYes
Outlook Files.pst, .ost, .msg, .emlFullYes
OneNote.oneFullNo
Publisher.pubLimitedYes
Visio.vsd, .vsdxLimitedYes

​
PDF and E-books

FormatExtensionsParsingOCR Support
PDF.pdfFullYes (scanned PDFs)
EPUB.epubFullNo
MOBI.mobiFullNo
AZW.azw, .azw3LimitedNo

​
LibreOffice/OpenOffice

FormatExtensionsParsingThumbnail Support
Writer.odt, .ottFullYes
Calc.ods, .otsFullYes
Impress.odp, .otpFullYes
Draw.odgFullYes

​
Apple iWork

FormatExtensionsParsingNotes
Pages.pagesFulliWork 13+ supported
Numbers.numbersFulliWork 13+ supported
Keynote.keynoteFulliWork 13+ supported

​
Other Document Formats

  • Rich Text Format (.rtf)
  • Plain Text (.txt, .log)
  • CSV (.csv)
  • HTML/XHTML (.html, .htm, .xhtml)
  • XML (.xml)
  • Markdown (.md)
  • LaTeX (.tex)

​
Image Formats

​
Standard Image Formats

FormatExtensionsThumbnailMetadataSimilarity Search
JPEG.jpg, .jpegYesEXIF, IPTC, XMPYes
PNG.pngYesXMPYes
GIF.gifYesXMPYes
BMP.bmpYesLimitedYes
TIFF.tif, .tiffYesEXIF, IPTC, XMPYes
WebP.webpYesEXIF, XMPYes
SVG.svgYesLimitedNo
ICO.icoYesNoYes

​
RAW Camera Formats

Camera BrandExtensionsSupport Level
Canon.cr2, .cr3, .crwFull
Nikon.nef, .nrwFull
Sony.arw, .srf, .sr2Full
Olympus.orfFull
Panasonic.rw2, .rawFull
Fujifilm.rafFull
Pentax.pef, .ptxFull
Adobe.dngFull

​
Apple Image Formats

FormatExtensionsParsingFrame Extraction
HEIC/HEIF.heic, .heifFullYes (animated sequences)
APNG.apngFullYes (animated)

​
Video Formats

FormatExtensionsParsingFrame ExtractionTranscoding
MP4.mp4, .m4vFullYesYes
AVI.aviFullYesYes
MOV.movFullYesYes
MKV.mkvFullYesYes
WebM.webmFullYesYes
FLV.flvFullYesYes
WMV.wmv, .asfFullYesYes
MPEG.mpg, .mpeg, .m2vFullYesYes
3GP/3G2.3gp, .3g2FullYesYes
VOB.vobFullYesYes
HEVC.hevc, .h265FullYesYes
Dahua DAV.davFullYesYes
Video frame extraction settings are configurable in VideoThumbsConfig.txt. You can extract frames as a function of video duration or at fixed intervals.

​
Audio Formats

FormatExtensionsParsingTranscription Support
MP3.mp3FullYes
WAV.wavFullYes
AAC.aac, .m4aFullYes
FLAC.flacFullYes
OGG.ogg, .ogaFullYes
Opus.opusFullYes
WMA.wmaFullYes
AMR.amr, .awbFullYes
3GPP Audio.3gp, .3g2FullYes
Speex.spxFullYes
iLBC.ilbcFullYes
QCELP.qcpFullYes
CAF.cafFullYes

​
Archive and Compression

FormatExtensionsExpansionCarving Support
ZIP.zip, .zipxYesYes
RAR.rarYesYes
7-Zip.7zYesYes
TAR.tar, .tar.gz, .tgzYesYes
GZIP.gzYesYes
BZIP2.bz2YesYes
XZ.xzYesNo
CAB.cabYesNo
ISO.isoYesYes
DMG.dmgLimitedNo

​
Email and Communication

​
Email Formats

FormatExtensionsParsing LevelAttachment Extraction
PST/OST.pst, .ostFullYes
MBOX.mboxFullYes
EML.emlFullYes
MSG.msgFullYes
EMLX.emlxFullYes
DBX.dbxFullYes
Apple MailVariousFullYes

​
Instant Messaging

ApplicationDatabase TypesParsing LevelMedia Recovery
WhatsApp.db, .crypt*FullYes
Telegram.dbFullYes
Skype.dbFullLimited
DiscordCache filesFullYes
Threema.dbFullYes

​
Mobile Forensics

​
iOS Formats

  • iTunes Backup parsing
  • Property List files (.plist, binary plist)
  • SQLite databases
  • NSKeyedArchiver files
  • LZFSE compressed files (iCloud backups)

​
Android Formats

  • Android Package (.apk)
  • SQLite databases
  • XML preferences
  • WhatsApp databases (all versions)

​
Cellebrite UFDR

  • Full UFDR report parsing
  • Physical Analyzer 8, 9, 10+ support
  • Contact and email view files
  • Chat message extraction
  • Location data from PA 10+
  • Media classification properties

​
Database Formats

FormatExtensionsParsingTable Extraction
SQLite.db, .sqlite, .sqlite3FullYes
Microsoft Access.mdb, .accdbFullYes
dBase.dbfFullYes

​
Multimedia Metadata

​
Metadata Standards

  • EXIF - Exchangeable Image File Format
  • IPTC - International Press Telecommunications Council
  • XMP - Extensible Metadata Platform
  • ID3 - Audio metadata (MP3 tags)
  • Vorbis Comments - OGG metadata
  • QuickTime Metadata - MOV/MP4 metadata

​
File Carving Support

​
P2P and File Sharing

ApplicationFile TypesParsing
eMule.part, .part.met, known.metFull
BitTorrent.torrent, resume.dat, settings.datFull
Shareaza.sd, Library1.dat, Library2.datFull
AresHistory filesFull
TransmissionControl filesFull
uTorrentVariousFull

​
Specialized Formats

​
Financial

  • OFX (.ofx) - Open Financial Exchange
  • QFX (.qfx) - Quicken Financial Exchange

​
System Artifacts

  • Windows Registry - Full parsing
  • LNK Files (.lnk) - Shortcut analysis
  • Jump Lists - Automatic and custom destinations
  • Prefetch (.pf) - Windows prefetch files
  • EVTX - Windows Event Logs
  • Activities Cache - Windows Timeline
  • USN Journal - NTFS change journal
  • TOR Browser history

​
Graphics and Design

  • Adobe Photoshop (.psd)
  • Windows Metafile (.wmf, .emf)
  • JBIG2 (.jb2, .jbig2)

​
Format Detection

IPED uses Apache Tika for signature-based file type detection, which:
  • Identifies files by content signature, not just extension
  • Detects file type mismatches
  • Handles files with incorrect or missing extensions
  • Supports custom signature definitions
File signature processing can be controlled with the processFileSignatures option in IPEDConfig.txt.

Build docs developers (and LLMs) love

Get started for freeTalk to us