Skip to content
Disk Image Parser

Client-side disk forensics

Disk image forensics, in your browser.

Drop a disk image to read its MBR/GPT partition table and identify every filesystem — NTFS, FAT, exFAT, ext. Parsed locally in WebAssembly; the image never leaves your device.

Synthetic 1.7 MB disk from a fictional intrusion (FIN-WKS-07) — no real data. Tip: in Files, the “Last hour” time-range preset isolates the intrusion.

How to get your data

Never imaged a disk? Pick the easiest route that fits: each one is a single command or a few clicks, and produces a file this page opens.

  1. CollectImage the disk, VM or files you need.
  2. Drop it hereThe file, or every segment of a set at once.
  3. Stays in your browserParsed locally in WebAssembly, never uploaded.

Windows: FTK Imager (E01)Recommended

Needs: FTK Imager run as administrator, and an external drive with enough free space for the image.

  1. File › Create Disk Image… › Physical Drive, then pick the drive.
  2. Add… › E01 › Next, and fill in the case details (optional).
  3. Image Destination Folder: a folder on the external drive (e.g. E:\triage), Image Filename: disk01 › Finish.
  4. Keep “Verify images after they are created” ticked and click Start.

You get: disk01.E01 (plus .E02, .E03… if it is split into fragments): select them all and drop them together.

Linux: dd (raw image)

Needs: sudo. Find the device with lsblk and replace sdX with it (e.g. sdb). ~/triage must be on another disk with enough free space.

lsblk -o NAME,SIZE,MODEL,SERIAL
mkdir -p ~/triage && sudo dd if=/dev/sdX of=$HOME/triage/disk.dd bs=4M status=progress

You get: ~/triage/disk.dd, a raw image ready to drop.

macOS: dd (raw image)

Needs: An admin password (sudo). Replace N with the disk number from diskutil list (rdiskN is the faster raw node). Press Ctrl+T to see progress.

diskutil list external
diskutil unmountDisk /dev/diskN
mkdir -p ~/triage && sudo dd if=/dev/rdiskN of=$HOME/triage/disk.dd bs=1m

You get: ~/triage/disk.dd, a raw image ready to drop.

Gotchas

  • dd and ewfacquire write exactly where you point them: double-check the source device, and never save the image onto the disk you are imaging.
  • An image of a BitLocker-encrypted drive stays ciphertext here (BitLocker is detected, not decrypted). On a live, unlocked Windows machine, image the Logical Drive (C:) in FTK Imager instead.
  • VM checkpoints and snapshots: the base disk misses the newest writes, and delta disks (.avhdx, -000001.vmdk) cannot be opened alone. Merge them on a copy first.
uploaded, ever
0 bytes
image formats
10
filesystem families
8
triage collections
35

Capabilities

A forensic workbench, without the install.

The everyday work of an imager and a file-system browser, in one tab.

Every evidence container

EnCase E01, Ex01 and SMART (multi-segment), AccessData AD1, AFF4, VMDK, VHD and VHDX, raw and split raw. Multi-GB images are streamed from disk through their block tables, never loaded whole.

Containers
  • E01 · Ex01 · S01
  • AD1 · AFF4
  • VMDK
  • VHD · VHDX
  • RAW · 001
Filesystems
  • NTFS
  • FAT
  • exFAT
  • ext2/3/4
  • XFS
  • HFS+
  • APFS
  • ISO 9660
  • UDF

Every filesystem

NTFS with alternate data streams and deleted MFT records, FAT, exFAT, ext2/3/4, XFS, HFS+ and APFS, with MACB timestamps. LUKS volumes unlock with their passphrase or volume key; BitLocker is flagged.

Deleted data

Deleted entries, file slack and unallocated space as a file you can export, plus signature carving across the whole image.

One-click triage

Registry hives, event logs, $MFT, browser history, persistence, bootloaders and more, each as a ZIP with a SHA-256 manifest.

Verify and hash

MD5 and SHA-1 over the image, checked against the hashes stored in E01; per-file hashes and a CSV directory listing.

Export

Re-encode to E01, convert to raw or VHD, build AD1 logical images, or ZIP the files you select.

How it works

Three steps, zero uploads.

  1. 01

    Drop the image

    Drag an E01, VMDK, AD1 or raw image onto the page. For split sets, select every segment at once.

  2. 02

    It is parsed on your machine

    A WebAssembly engine in a background worker reads the partitions and filesystems. Large images are read on demand, straight from disk.

  3. 03

    Collect and export

    Browse, preview and hash files, run a triage collection, or export to E01, AD1 or ZIP.

Privacy by architecture

The evidence never leaves your machine.

There is no server-side processing. The file you drop is read by code running in your tab, and none of its bytes are sent anywhere. That keeps chain of custody simple and lets you work on sensitive cases from any machine with a browser.

  • No upload, no account
  • Runs in a sandboxed Web Worker
  • Streams multi-GB images from disk
  • Check it yourself in the network panel

FAQ

Questions, answered.

Is my disk image uploaded anywhere?

No. Parsing happens in your browser tab with WebAssembly, and the file's bytes never leave your machine. You can confirm it in your browser's network panel while an image is open.

Which image formats can it open?

EnCase E01 and Ex01 (including multi-segment sets) and SMART S01, AccessData AD1, AFF4, VMware VMDK (flat, sparse and split), Microsoft VHD and VHDX, and raw/dd images including split .001 sets and optical disc .iso images.

Which filesystems are supported?

NTFS, FAT12/16/32, exFAT, ext2/3/4, XFS (V4 and V5), HFS+, APFS, and the optical disc filesystems ISO 9660 (with Joliet and Rock Ridge) and UDF. LUKS1/LUKS2 volumes can be unlocked in the browser with their passphrase or volume key and then browsed like any partition; BitLocker volumes are detected but not decrypted yet.

How large an image can I open?

Every disk container is streamed from disk — raw and split raw, E01/Ex01, VHD, VHDX and VMDK (including split sets) — so images of tens or hundreds of gigabytes work. AD1 logical images are loaded into memory, which browsers cap at about 2 GB.

Is it free? Do I need an account?

It is free to use, and there is no account or sign-up.

Can it replace FTK Imager?

For opening, browsing, hashing and exporting from images, often yes, from any machine with a browser. It does not acquire physical disks, and it does not decrypt BitLocker volumes (LUKS volumes it can unlock).

Related tools

MFT Parser
Parse the $MFT you export from the image: every file, deleted entries and both timestamp sets.
USN Parser
Parse $UsnJrnl:$J from the same image to see file changes in order.
Registry Parser
Open the SYSTEM, SOFTWARE and NTUSER.DAT hives you pull from the image.

From the field notes

Read the blog
Carve deleted data from unallocated space
How deleted files survive in unallocated clusters, how to pull them out by signature, and the reasons (TRIM, fragmentation) the data often is not there.
dfirforensicsdata-recoverycarving
FTK Imager alternatives that run in your browser
What actually replaces FTK Imager for browsing and exporting from a disk image, where the browser wins, and where you still need the real thing.
ftk-imagerdfirforensicse01
Open a disk image online without uploading it
Most online disk image viewers upload your evidence to a server. Here is how to read one in the browser with nothing leaving the machine, and how to prove it.
dfirforensicsprivacye01

Open your first image in seconds.

No install, no upload, no account. Drop an image and start browsing.

Open a disk image