What is the DD file format?
The .dd file is a raw disk image - a bit-for-bit copy of every sector on a disk, partition, flash card or other storage medium. It is the direct output of the Unix dd command and of dedicated forensic imaging tools such as dcfldd and dc3dd. Because it captures everything on the source - including boot sectors, partition tables, unallocated space and deleted-file remnants - .dd is a standard format in data recovery and digital forensics.
A .dd image has no container or header of its own; the file begins at offset zero with the exact bytes from the source medium. A whole-disk image starts with an MBR or GPT partition table; a partition image starts with a filesystem boot sector. Identifying the content requires reading embedded structures: the FAT/NTFS signature 55 AA at offset 510, the GPT magic EFI PART at offset 512, or an ext4 superblock magic 0x53EF at offset 0x438 within a partition.
The .dd format is interchangeable with .img and .raw - most imaging and forensic tools treat them identically. When compression or chain-of-custody metadata are needed, images are typically compressed with gzip or converted to the E01 forensic container, which embeds MD5/SHA-256 hashes and case notes alongside the raw data.
Note: the .dd extension was also historically used by Doodle!, a raster graphics program for the Commodore 64. That legacy picture format is entirely unrelated to disk imaging.
Security & safety
RISK: MEDIUMA .dd is passive raw data and won't run on its own, but it carries real cautions. First, it can contain anything the source disk did - including malware and, in forensic images, sensitive personal data and deleted-file remnants - so mount it READ-ONLY (and ideally in an isolated environment) and handle it carefully. Second, WRITING a .dd back to a disk with 'dd' or balenaEtcher overwrites the entire target device, so a wrong device name wipes the wrong disk. Third, when imaging for evidence, hash the image (MD5/SHA-256) and use a write blocker so the copy is provably unaltered. Download forensic tools (FTK Imager, Autopsy, Sleuth Kit) only from their official vendors.
Format details
in a nutshell- Doodle (Commodore 64) image - A rare 1980s C64 hi-res bitmap (typically 9026 bytes, often actually named 'dd' as a filename prefix); only relevant to retro/emulator users, not modern disk images.
- DiskDoubler compressed file (classic Mac OS) - Symantec's DiskDoubler used .dd for compressed files on classic Mac OS; obsolete, opened only by The Unarchiver/old Mac tools.
Programs that open DD files
Windows4 apps
7-Zip
Open-source Right-click > 7-Zip > Open archive to browse and extract files from many .dd images without mounting. 
FTK Imager
Free File > Add Evidence Item > Image File, select the .dd, then browse and export files from the embedded filesystems. The standard free forensic viewer.
OSFMount / Arsenal Image Mounter
Free Mount the .dd as a read-only virtual disk and browse it in Explorer like a normal drive.
Autopsy (The Sleuth Kit)
Open-source Create a case and add the .dd as a data source for full forensic analysis (file carving, timelines, deleted files). 
macOS2 apps
hdiutil / Disk Utility (built-in)
Built-in Attach the raw image: 'hdiutil attach -imagekey diskimage-class=CRawDiskImage disk.dd' (read-only) to mount and browse it.
The Sleuth Kit / Autopsy
Open-source Use TSK command-line tools (fls, icat) or Autopsy to examine the .dd image and extract files. 
Linux3 apps
mount (loop device, built-in)
Built-in For a partition image: 'sudo mount -o loop,ro disk.dd /mnt'. For a whole-disk image, attach with 'losetup -fP disk.dd' then mount the partition (e.g. /dev/loop0p1).
The Sleuth Kit / Autopsy / Guymager
Open-source Examine with TSK (fls/icat) or Autopsy; create/verify raw images with Guymager or 'dd'/'dcfldd'.
dd / dcfldd (CLI)
Open-source Create: 'dd if=/dev/sdX of=disk.dd bs=4M'. Restore: 'dd if=disk.dd of=/dev/sdX bs=4M' (the target is overwritten - choose the device carefully). Technical details
deep spec| Container | None - raw binary sectors with no wrapper, header or metadata of any kind |
| Encoding | Binary (byte-for-byte copy of the source medium) |
| File size | Mirrors the source exactly - from a few KB for small partitions to multiple TB for whole disks |
| Magic bytes | None intrinsic; whole-disk images expose an MBR signature 55 AA at offset 510 or GPT "EFI PART" at offset 512 |
| Compression | None embedded; commonly archived post-capture with gzip, bzip2 or zstd (producing .dd.gz, .dd.bz2, etc.) |
| Encryption | None at the image level; source volumes may contain BitLocker, LUKS or FileVault data |
| Integrity | No built-in checksum; forensic practice stores a separate MD5 or SHA-256 hash of the image file alongside it |
| MIME type | application/octet-stream |
| Mountability | Mountable as a loop device on Linux (losetup / mount); via OSFMount or Arsenal Image Mounter on Windows; via hdiutil on macOS |
| Captured scope | Every byte of the source - filesystem structures, boot sectors, slack space, unallocated space and deleted-file artefacts |
| Create command | dd if=/dev/sdX of=image.dd bs=4M status=progress |
| Primary use | Digital forensics, data recovery, disk cloning and virtual machine provisioning |
| Interchangeability | Functionally identical to .img and .raw; most imaging and forensic tools treat all three as the same format |
| Forensic variants | dcfldd and dc3dd add on-the-fly MD5/SHA-256 hashing during acquisition; EWF/E01 wraps the same raw data with embedded hashes and case metadata |
| Released | The 'dd' utility dates to early Unix (1970s); raw imaging is a long-standing convention |
| Latest version | No format version - a .dd is just raw bytes; tooling evolves (GNU coreutils dd, dcfldd, dc3dd, ewfacquire) |
| Open standard | Yes · royalty-free |
| Specification | en.wikipedia.org |
DD conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about DD files.
