AD1 File Extractor
Open an AD1 file on Windows without FTK Imager. AD1 file extractor opens the logical tree inside and exports what matters.
Version 26.7 · Windows 11, Windows 10, Windows 8.1, Windows 7 and Windows Server
Open an AD1 file on Windows without FTK Imager. AD1 file extractor opens the logical tree inside and exports what matters.
Version 26.7 · Windows 11, Windows 10, Windows 8.1, Windows 7 and Windows Server
An AD1 holds selected files and folders, not a disk, although it is still called an image.
Inside the logical image
What AD1 extractor software opens, and what it pulls out of an AccessData container, before anything reaches the desktop.
AD1 file extractor opens a single container and follows a segmented set across .ad1, .ad2 then .ad3 in order. Only the first segment carries the logical image header, so the rest mean nothing on their own.
A logical container already holds a folder tree, so no partition table and no filesystem stand in the way. Browse straight to the collected folders, which is where an AD1 differs from a sector by sector disk image.
The container opens on an ordinary Windows desktop, with nothing from AccessData or Exterro present on that machine. It matters when the collection arrives from outside and no forensic suite is available.
Per-file MD5 and SHA1 values stored inside the container are lifted out and shown beside every entry. Access, modified and change timestamps plus Windows attribute flags come through with the file itself.
File data sits in zlib chunks of 65,536 bytes, and those chunks are decoded while the container loads. There is no setting to select and no unpack step before browsing.
Search the tree or browse it, then tick one document and export it on its own. A custodian collection often runs to thousands of files when three of them are what anyone asked for.
An AD1 container opens on its own, with FTK Imager nowhere in sight.
Run the Free DemoFive steps from a collection on a drive to the documents that matter.
Use Open File and point it at the .ad1, the first part of any set. When a collection runs across .ad2 and .ad3 as well, use Open Folder and point it at whichever directory holds them all. Parts are matched by their numbering, so names must stay as the collecting tool wrote them.
Identification runs on the signature at the head of the file, ADSEGMENTEDFILE, with ADLOGICALIMAGE marking the logical header that follows. A renamed container still opens, and File Details reports version 3 or version 4 before anything is committed.
Folders appear exactly as they were collected, with per-file hashes and timestamps beside every entry. No partition table is parsed here, because an AD1 never held one.
Use the search option on a file name or walk the tree, then tick one folder, one branch or a single document. A collection gathered from several custodians is usually far larger than the handful of files anyone actually wants back.
Files leave the container with their original directory structure and both timestamps, created date and modified date. The tool opens an AD1 read only and never writes to it.
Only the size of ticked files once decompressed, not the size of an entire collection, the same reason people restore individual files from an image backup instead of the full set. It matters most when the AD1 set is bigger than the free space available.
Not a disk. A tree of files somebody chose to collect.
AccessData Custom Content Image
A container holding selected files and folders, every one carrying its own metadata. The file opens with ADSEGMENTEDFILE, then a logical image header at offset 0x200. Windows has no reader for any of it.
The two versions in the wild
Only two image version values are valid, 3 and 4. Both open here the same way, and File Details names which one wrote the container, so an older collection needs no special handling.
One collection, numbered parts
A large collection is split into numbered parts, written in sequence. Middle parts carry neither the logical header nor the footer, so they are pieces of one container rather than containers of their own.
Yes. An AD1 extractor opens one on Windows, with no forensic suite installed.
AccessData never published the layout, so the format is closed. Closed is not encrypted, and the structure has since been documented in public through reverse engineering work. Once the header and the zlib chunks are understood, the tree inside lists like any other folder.
What is not required
An FTK or AccessData licence
A forensic suite installed on the machine opening the AD1 file
A Linux box and a command line mount
The machine the collection was taken from
Four routes open an AccessData container, and two of them cost nothing. Every route depends on something that may be missing, so the right one varies.
When FTK Imager is already installed and the workflow is familiar, start there. Everything below this line covers the case where a collection arrives from outside with no forensic tooling to hand.
| Route | Opens AD1 |
Follows segments |
What it gives | The catch |
|---|---|---|---|---|
| FTK Imager Free |
The tool that wrote the format. Add Evidence Item, choose Image File, browse the tree and export selected files. Free, and capable on Windows | An acquisition tool built for examiners, so its workflow assumes an examiner's habits. Downloads sit behind a vendor account | ||
| Forensic Toolkit Paid |
The full AccessData suite, now sold by Exterro. Opens its own containers alongside case management, indexing and review | An examiner seat priced for a forensic lab, and far more product than a folder of documents calls for | ||
| AD1-tools on Linux Free |
An open source project that opens, extracts and mounts an AccessData container from a Linux host | Linux and the command line. No help at all on a Windows desktop, which is where most collections land | ||
| Windows or 7-Zip Built in |
Nothing. Windows has no reader for this format and a general archive tool cannot parse the header | Double-clicking the file produces an Open With prompt and nothing else |
FTK Imager and AD1-tools both do the job, and neither is aimed at someone who needs four documents back from a collection a consultant left behind. One asks for a forensic acquisition workflow, the other for Linux and a mount command. AD1 extractor software is the Windows middle ground, a file browser over the container that exports what is ticked.
AD1 file extractor at a glance
A large collection is written across .ad1, .ad2 and .ad3 in sequence, so those files are one container in pieces. Only the first part carries the logical image header.
One part on its own
Hand the tool a lone .ad2 and there is no header and no file tree, so nothing opens. A missing part in the middle cuts the listing short at that point. Copy all AD1 parts off that drive, not whichever file is named first.
All parts in one folder
Put all parts in one folder, keep their original file names and use Open Folder. The parts are joined back into one container, the tree loads once and every collected folder appears as it stood at collection time.
AD1 is a Forensic edition format, beside the other evidence containers.
AD1 extractor tool ships in Forensic at $199 as a one time purchase, covering up to 10 machines with a perpetual licence and twelve months of updates and support. It holds everything in Professional and adds EnCase evidence and logical evidence files, AFF and AFF4 containers, LiME and AVML memory captures, plus deleted file recovery for FAT and NTFS with a recoverability rating on every result.
This is the format AccessData built for collecting part of a machine rather than all of it, and FTK Imager gave it away free.
That is why AD1 files turn up far outside forensic labs. A container with no obvious source usually traces back to one of the collections below. The engagement ended, the consultant moved on or the case closed, although the collection stayed on the drive.
Free, and the most common source of these containers. An examiner ticks folders in the tree and exports them into one container.
A responder gathers logs, profiles and a handful of directories from a live machine instead of imaging an entire disk, often while checking for anti forensics techniques.
One container per custodian keeps a collection tidy and portable, which is why legal teams receive them from outside counsel.
A leaver's documents are collected into one file before the laptop is rebuilt, then nobody keeps a reader for it.
Questions that come up once the collection will not open
No. AD1 is a closed format, and it is not encrypted, so its layout can be parsed without the vendor tool. Dedicated AD1 extractor software opens your container, decodes the zlib chunks inside and lists the collected tree. Nothing from AccessData or Exterro needs to be installed or licensed.
No, and the distinction matters. An AD1 is a logical container holding the files and folders somebody ticked, so there is no partition table, no filesystem and no unallocated space inside it. A physical image like E01 holds an entire disk sector by sector. If your AD1 is missing a file, that file was never collected.
Not on their own. Opening one needs the .ad1, because the logical image header and the start of the file tree sit there, and middle parts carry no header at all. Go back to whichever drive your set came from and copy all parts across, keeping their original names. A gap in the middle cuts the listing short rather than stopping it opening.
Yes, where the collecting tool wrote them. An AD1 stores hashes per file rather than one hash for the container, so every entry can carry its own MD5 and SHA1. Those values are lifted out and shown beside the file, together with access, modified and change timestamps and the Windows attribute flags. Hash values are what an examiner leans on, from a disk collection through to a Gmail email forensics investigation.
AD1 is logical and E01 is physical. An AD1 holds the files and folders selected at collection time. An E01 holds an entire disk, so partitions, filesystems and deleted data all sit inside it. Both open in Backup Extractor under the Forensic edition, and the E01 file extractor page covers that side.
Version 3 and version 4, which are the only image version values an AD1 carries. Both load the same way and File Details names which one wrote your container, so a collection made years ago needs no special handling.
A protected container is flagged when it loads, and the contents stay locked. If you hold the credential, remove the protection with the AccessData product that wrote it and open the result here. Backup Extractor is a reader, not a password recovery tool.
No. The container stays strictly read only, so nothing is written back into it at any point. All processing happens on your own computer with nothing sent anywhere, so that container opens again later and behaves identically.
AD1 extractor opens the container, runs the validation pass a paid build uses and lists all files and folders inside it. Writing the files out is the part that needs a licence. That is enough to prove your own collection is readable before you spend anything.
Yes. Matching runs on the ADSEGMENTEDFILE signature at the head of the file rather than the name, so a renamed or extensionless container loads the same way. A renamed set is different, because parts are matched to one another by their numbering. Keep the original names within a set.
Forensic at $199. Standard covers archive formats and Professional covers backup software and virtual disks, so neither one opens an AD1 file. Forensic is the edition that opens AD1, the EnCase containers, AFF and AFF4, plus LiME and AVML memory captures.
AD1 File Extractor
AD1 extractor loads the container, shows what it holds and exports only the documents needed.
Free Demo Download Purchase Now
Version 26.7 · Windows 11, Windows 10, Windows 8.1, Windows 7 and Windows Server · 30 day money back
BitRecover has been building data recovery and format conversion tools since 2011. The AccessData support described on this page reflects the current Backup Extractor release.
The full tool, 34 format families across backup archives, tape, virtual disks and forensic containers
For the physical side, an EnCase image of an entire disk rather than a folder of collected files
For an Acronis disk image on the same drive, with no True Image left to open it