Supported Formats
The information below is based of version 20221207
Storage media types
EWF (EWF-E01, EWF-Ex01, EWF-S01) (Requires: libewf/pyewf)
Mac OS disk image (Requires: libmodi/pymodi)
Sparse bundle disk image
Sparse disk image
Universal Disk Image Format (UDIF) image
Parallels Hard Disk image format version 2 (Requires: libphdi/pyphdi)
QCOW version 1, 2, 3 (Requires: libqcow/pyqcow)
currently no differential image support
Storage Media device (Requires: libsmdev/pysmdev)
(split) Storage Media RAW (Requires: libsmraw/pysmraw)
VHD and VHDX (Requires: libvhdi/pyvhdi)
VMDK (Requires: libvmdk/pyvmdk)
currently no differential image support
Volume systems
Apple File System (APFS) container version 2 (Requires: libfsapfs/pyfsapfs)
BitLocker Disk Encryption (BDE) (Requires: libbde/pybde)
Core Storage (CS) including FileVault Disk Encryption (FVDE) (or FileVault 2) (Requires: libfvde/pyfvde)
GPT (Requires: libvsgpt/pyvsgpt or libtsk/pytsk)
LVM (Requires: libvslvm/pyvslvm)
At the moment only single physical volume LVM support
Linux Unified Key Setup (LUKS) (Requires: libluksde/pyluksde)
Volume Shadow Snapshots (VSS) (Requires: libvshadow/pyvshadow)
File systems
Apple File System (APFS) version 2 (Requires: libfsapfs/pyfsapfs)
ext version 2, 3, 4 (Requires: libfsext/pyfsext or libtsk/pytsk)
FAT-12, FAT-16, FAT-32 and exFAT (Requires: libtsk/pytsk or libfsfat/pyfsfat)
HFS+, HFSX (Requires: libfshfs/pyfshfs or libtsk/pytsk)
NTFS version 3 (Requires: libfsntfs/pyfsntfs or libtsk/pytsk)
XFS version 4, 5 (Requires: libfsxfs/pyfsxfs)
Compressed stream file types
bzip2
gzip
lzma
xz
zlib (both zlib+DEFLATE and stand-alone DEFLATE)
Encoded stream file types
base16
base32
base64
Encrypted stream file types
AES-CBC, AES-CFB, AES-ECB, AES-OFB (Requires: Cryptography.io)
Blowfish (Requires: Cryptography.io)
DES3 (Requires: Cryptography.io)
RC4 (Requires: Cryptography.io)
Archive file types
cpio
tar
zip
Other file types
blob stored in SQlite