Inspect Hidden Partitions in Raw Disk Dumps Using 7-Zip

This guide explains how to use 7-Zip as a lightweight forensic utility to inspect partition layouts and uncover hidden partitions within raw disk dumps. While primarily an archiving tool, 7-Zip includes built-in parsers for Master Boot Record (MBR) and GUID Partition Table (GPT) structures. By opening raw sector-by-sector disk images directly in 7-Zip, you can examine hidden system partitions, OEM recovery areas, and unlisted volumes without mounting the image to the host operating system.

1. Prepare the Raw Disk Dump

7-Zip can parse raw binary disk dumps natively, including files with extensions such as .img, .vhd, or .bin. If your dump was created using tools like dd, FTK Imager, or ddrescue and has a .dd or .raw extension, 7-Zip might not recognize it via double-click associations. In this case, you can either append .img to the filename or open it directly through the 7-Zip File Manager interface.

2. Open the Dump as an Archive

To inspect the partition scheme:

  1. Open 7-Zip File Manager.
  2. Navigate to the directory containing the disk image.
  3. Select the file, right-click it, and choose Open archive.
  4. Alternatively, from the Windows Explorer context menu, right-click the file and select 7-Zip > Open archive.

If the context menu does not offer the "Open archive" option, select 7-Zip > Open archive > * to force 7-Zip to analyze the file signature and parse any detected file systems or partition tables.

3. Read the Partition Structure

When 7-Zip opens a full-disk dump containing a valid partition table, it displays each partition as an individual item inside the root level of the archive. These items represent the physical layout of the disk:

  • Partitions are typically named numerically by their order on the disk (for example, 0.img, 1.fat, 2.ntfs).
  • File extensions appended by 7-Zip indicate detected file systems, such as NTFS, FAT32, EXT, or raw binary streams (.img).
  • Hidden OEM recovery partitions, EFI System Partitions (ESP), and Microsoft Reserved (MSR) partitions appear in this view, even if they lack drive letters or are flagged as hidden in standard operating systems.

4. Analyze Partition Metadata

To inspect the properties of hidden volumes:

  1. Select the partition inside the 7-Zip window.
  2. Click Info on the toolbar or press Alt + Enter.
  3. Review the size, compressed size, and file system characteristics. The offset and raw sector boundaries can be determined by comparing partition sizes against the full image size.

5. Browse and Extract Hidden Content

Double-click any detected file system volume within 7-Zip to open it like a folder. 7-Zip will parse the volume's internal directory tree, allowing you to:

  • Browse files inside hidden or protected volumes without altering file timestamps or access metadata on the host.
  • Extract specific files or full directory trees by dragging them to a local destination or clicking Extract.
  • Extract entire sub-partitions as separate .img files for deeper analysis in specialized forensic suites.