{
 "id": "accessdata-custom-content-image-encrypted",
 "name": "AccessData Custom Content Image (Encrypted)",
 "category": "archive",
 "identifiers": {
  "extensions": [
   "ad1",
   "ad2",
   "ad3",
   "ad4",
   "ad5"
  ],
  "puid": [
   "fmt/843"
  ],
  "wikidata": [
   "Q62484762"
  ],
  "magic": [
   {
    "offset": 0,
    "hex": "41444352595054",
    "notes": "AD1 (encrypted)"
   }
  ],
  "signatures": [
   {
    "name": "AD1 (encrypted)",
    "sequences": [
     {
      "position": "bof",
      "offset": 0,
      "pattern": "41444352595054"
     }
    ]
   }
  ]
 },
 "status": "unknown",
 "summary": "The AccessData Custom Content Image (AD1) file format is a file-level disk image format created by AccessData's proprietary forensic software, such as FTK Imager. AD1 images may be encrypted or unencrypted. Encrypted images have only a small unencrypted chunk at the beginning of the file, beginning with the magic bytes \"ADCRYPT\" at byte 0.",
 "tools": [
  {
   "name": "Forensic Toolkit",
   "url": "http://accessdata.com/products-services/forensic-toolkit-ftk",
   "reads": true,
   "writes": true
  }
 ],
 "projects": [
  {
   "name": "PRONOM fmt/843",
   "url": "https://www.nationalarchives.gov.uk/PRONOM/fmt/843",
   "kind": "format-doc"
  },
  {
   "name": "Wikidata Q62484762",
   "url": "https://www.wikidata.org/wiki/Q62484762",
   "kind": "wiki"
  }
 ],
 "provenance": {
  "sources": [
   "pronom",
   "wikidata"
  ]
 },
 "updated": "2026-10-20",
 "aliases": [],
 "structure": [],
 "parsers": [],
 "conversions": [],
 "samples": [],
 "claims": [],
 "verification": []
}