mrimg-reader

An open-source tool to read and extract files from Macrium Reflect .mrimg backup images on macOS and Linux — no Windows required.

Why?

Macrium Reflect was a popular Windows backup tool that created .mrimg disk images. The format is proprietary with no published specification, and the only official way to read these files is through the Windows-only Macrium Reflect software (which has been discontinued for free/home use).

Millions of .mrimg backup files exist on old hard drives, NAS devices, and cloud storage. Many contain irreplaceable personal data — photos, documents, projects — locked behind a proprietary format with no cross-platform reader.

This project aims to reverse-engineer the .mrimg v2 format and build a Python tool that can:

1. List the partitions and metadata in an .mrimg file
2. Extract the raw disk image (convertible to .raw, .vhd, etc.)
3. Browse and extract individual files without full restoration

Current Status: Reverse Engineering In Progress

What We Know

File Structure (v2 format, Macrium Reflect v5.x)

Offset	Size	Description
0	13 bytes	Macrium header (version, flags, metadata)
13	varies	Partition data (multiple partitions stored sequentially)

Header Format (13 bytes)

Byte 0:     0x03 — Possibly format version or block type
Bytes 1-2:  0x83F8 — Flags or format identifier
Bytes 3-6:  0x00000000 — Reserved/offset
Byte 7:     0x01 — Partition count or flags
Bytes 8-12: 0x0000400084 — Block size or offset info

Data Storage

• Partitions are stored sequentially in the file
• The first NTFS boot sector starts immediately after the 13-byte header
• FAT32 partitions maintain correct internal sector spacing (backup boot sector at sector 6)
• Boot sector data contains readable strings but with byte-level transformations
• Strings are shifted by ~13 bytes relative to their expected NTFS positions
• Small binary markers (00 00 XX 80, 00 00 00 a0, etc.) are interspersed in the data
• The bulk data (>500KB) has very high entropy (~7.95 bits/byte), indicating compression

Compression

• NOT standard zlib, gzip, lzma, lz4, or bzip2
• Resembles LZNT1 (Windows NTFS compression) but doesn't decode cleanly with standard LZNT1
• Possibly a custom LZ variant or Microsoft XPRESS compression
• The 2-byte values at the start of chunks follow the LZNT1 header pattern (bit 15 = compressed flag, bits 0-11 = size)
• Compression ratio: ~10:1 overall (45GB file from ~450GB source)

Embedded Metadata

• Windows Recovery Environment XML configs found at offsets ~143KB, ~172KB, ~201KB
• UTF-8 BOM (EF BB BF) precedes XML sections
• Macrium Reflect HTML log embedded at ~411MB with backup details
• Partition table information available in the log

Sample File Analysis

The reference .mrimg file analyzed:

• Created: July 1, 2017
• Tool: Macrium Reflect v5.3.1835 (Free Edition)
• Format version: 2 (<Ver>2</Ver>)
• Source: HP laptop, Windows 8 (build 9200), amd64
• User: Rafael
• 5 partitions backed up:
  1. WINRE — ~400MB, NTFS (Windows Recovery Environment)
  2. Boot — ~256MB, FAT32 (EFI/boot)
  3. Unformatted — 128MB
  4. C: drive — ~420GB, NTFS (main Windows partition, 370GB used)
  5. RECOVERY — ~26GB (HP recovery)
• I/O performance: 464.7 MB/s
• Duration: ~25 minutes

What We Need to Figure Out

1. Block map format — How does the file index which source sectors are stored and where?
2. Compression algorithm — Exact compression used for sector data blocks
3. Partition boundaries — How partition sections are delimited in the file
4. Sector bitmap — How unused/empty sectors are skipped (key to the ~10:1 compression)

Installation

pip install mrimg-reader  # Coming soon

For development:

git clone https://github.com/leafarhz/mrimg-reader.git
cd mrimg-reader
pip install -e .

Usage (Planned)

# Show image info and partition list
mrimg-reader info backup.mrimg

# Extract partition to raw disk image
mrimg-reader extract backup.mrimg --partition 4 -o windows_c_drive.raw

# List files in a partition
mrimg-reader ls backup.mrimg --partition 4 /Users/

# Extract specific files
mrimg-reader extract-files backup.mrimg --partition 4 /Users/Rafael/Documents/ -o ./recovered/

Contributing

This is an active reverse-engineering project. Contributions welcome:

• If you have .mrimg files from different Macrium Reflect versions, hex dumps of headers would be invaluable
• If you have Windows access, running Macrium Reflect and comparing raw disk data with the .mrimg contents would help
• If you're experienced with compression formats, the block-level compression analysis needs work

See docs/format-notes.md for detailed reverse-engineering notes.

Dependencies

• Python 3.8+
• sleuthkit (optional, for filesystem-level extraction)

License

MIT

Acknowledgments

• Macrium Reflect for creating a reliable backup tool used by millions
• The digital preservation community for motivating this work