Disk Image Converter & Hash Verifier (E01, DMG, VHDX, VMDK to Raw)

About the Disk Image Converter & Hash Verifier (E01, DMG, VHDX, VMDK to Raw)

Imaging programs and virtual machines rarely save a disk as a plain sector-by-sector copy: EnCase and FTK Imager write E01 files, macOS writes DMG images, Windows and Hyper-V VHD and VHDX files, VMware VMDK disks, QEMU QCOW2 and VirtualBox VDI. This page opens any of them in your browser, shows what it holds, and reads the disk inside without unpacking a copy first.

You see the image’s details (an E01 also shows its case number, examiner and acquisition time), the partition map of the disk, and, after one pass over the whole disk, its MD5, SHA-1 and SHA-256. Every value the image stores is checked on the way: an E01’s MD5 and SHA-1 and the checksum of each chunk, a DMG’s CRC-32 for each partition and for the file, a VHDX file’s header checksums. Paste the hash from an imaging log to compare it.

Without a pass this is a free preview: the details, the partition map and every hash and check are shown in full. Saving the disk as a raw .img image (which every recovery page and forensic tool reads) and the PDF report need an Ultimate pass.

Common uses

• Turning an E01, DMG, VHDX or VMDK image into a raw image that recovery pages and forensic programs open.
• Checking that a copied or downloaded disk image is intact: its stored hashes and checksums, or the hash in an imaging log.
• Looking inside a virtual machine’s disk (its partitions and file systems) without starting the virtual machine.
• Recording a disk image’s details, partitions and hashes in a PDF report.

The formats it reads

• E01 (EnCase / Expert Witness, also S01 from SMART): chunks compressed with zlib or stored with an Adler-32, in one or more segments (.E01, .E02 … .EAA …).
• DMG (Apple disk images): read-only (UDRO) and compressed with ADC (UDCO), zlib (UDZO), bzip2 (UDBZ) or LZFSE (ULFO). A read-write DMG is already a raw image.
• VHD (fixed, dynamic and differencing) and VHDX (fixed, dynamic and differencing; a file Hyper-V did not close properly has its log replayed in memory first, as Hyper-V would, without changing the file).
• VMDK (VMware): monolithic or split, sparse or flat, the stream-optimized disks of OVA and OVF exports (an .ova file is a tar archive: take the .vmdk out of it first), and snapshot (delta) disks with their parents.
• QCOW2 (QEMU, KVM, Proxmox; versions 2 and 3, compressed clusters and backing files) and VDI (VirtualBox, with snapshots).
• Raw images (.img, .dd, .raw, .bin, .iso, .cdr) and raw images saved in parts (.001, .002 …), for the partition map and the hashes.

The readers follow the published descriptions of these formats: Microsoft’s VHDX specification, QEMU’s QCOW2 format, and libyal’s description of the EWF format. LZFSE is decoded with a port of Apple’s reference implementation (BSD licence).

Why the hashes match the original disk

The page hashes the disk inside the image, not the image file. So an E01’s MD5 is the MD5 of the drive that was imaged: the value the imaging program logged, and the value of any raw image of the same drive. Two images of one disk in different formats (an E01 and a raw image, a VMDK and the VHDX it was converted to) give the same hashes when they hold the same bytes.

The raw image this page saves is hashed as it is written, so its hashes are those of the file you get.

Images that leave deleted data out

Not every image keeps every sector. A compressed or read-only DMG that macOS converts from a disk leaves out the space the file system marks as unused, so files deleted before the image was made are not in it; the page says how much was left out. A dynamic VHD or VHDX reads blocks that were never written as zeros, and blocks the virtual machine trimmed as zeros too. An E01 or raw image of a whole drive keeps every sector, deleted data included. For recovery, image the drive itself as raw or E01, or as “DVD/CD master” in Disk Utility.

Measured on test images

Disk images that macOS made with hdiutil (UDRO, UDCO, UDZO, UDBZ and ULFO) and virtual disks that qemu-img made (VHD fixed and dynamic, VHDX fixed and dynamic, VMDK monolithic sparse, split sparse, flat and stream-optimized, QCOW2 versions 2 and 3 with and without compression, VDI dynamic and fixed) were read back byte for byte identical to the raw disk they were made from, and every CRC-32 the DMGs store matched. E01 images made with libewf’s ewfacquire (compressed, and uncompressed in two segments) matched the MD5 they store. These images are part of the page’s automated tests.

Limitations

• Not read yet: Ex01 and Lx01 (version 2 of the EnCase format), L01 logical evidence files, E01 images with AccessData encryption, LZMA-compressed DMGs (ULMO), encrypted or segmented DMGs, sparse images and sparse bundles, ESXi snapshot disks (VMFS sparse and SEsparse), and QCOW2 images that are encrypted or compressed with zstd. The page says which it is and how to convert it.
• Saving a raw image needs space for the whole disk on another drive: a 500 GB disk makes a 500 GB file, even when its image is small.
• Chrome and Edge on a computer write the raw image straight into a file of any size. Other browsers can only download what they hold in memory: up to 1 GB, or 512 MB on mobile devices.
• A web page cannot read a disk or memory card directly; this page works on image files only.
• Reading a large image takes time: the page reads and unpacks every sector once for the hashes, and once more to save it.
• This is not a court-validated forensic tool, and it makes no evidentiary claims. Keep the original image, and check important hashes with a second tool.

Privacy

The image files are read by your browser on your device, a few megabytes at a time, in a background worker; nothing is uploaded. The raw image is written only where you choose to save it.