Glossary
AD1 (AccessData logical image)
FTK Imager's logical evidence container: a file-and-folder tree stored as zlib-compressed items, not a bit-for-bit copy of a disk.
AD1 is the logical-evidence format FTK Imager writes when you create a Custom
Content Image. It is not a disk image. There is no partition table and no
filesystem to parse. Instead the container holds a flat list of file and folder
items, each carrying its own metadata and zlib-compressed data, behind a
512-byte segmented-file margin and an ADSEGMENTEDFILE / ADLOGICALIMAGE
header.
People reach for AD1 when imaging the whole disk is overkill or impossible: a handful of relevant files off a live system, the contents of one user profile, a targeted collection where a physical image would be disproportionate.
The parser reads AD1 into a browsable file tree with byte-exact extraction, and can also write one from a selected set of files.