Apple Disk Image

Last updated
Apple Disk Image
Mac OS X Disk Image.png
The icon depicts an internal hard drive within a generic file icon.
Filename extension
.dmg, .smi, .img
Internet media type
application/x-apple-diskimage
Uniform Type Identifier (UTI)
  • com.apple.disk-image
  • com.apple.disk-image-smi
Developed by Apple Inc.
Type of format Disk image

Apple [1] Disk Image is a disk image format commonly used by the macOS operating system. When opened, an Apple Disk Image is mounted as a volume within the Finder.

Contents

An Apple Disk Image can be structured according to one of several proprietary disk image formats, including the Universal Disk Image Format (UDIF) from Mac OS X and the New Disk Image Format (NDIF) from Mac OS 9. An Apple disk image file's name usually has ".dmg" as its extension. A disk image is a compressed copy of the contents of a disk or folder. Disk images have .dmg at the end of their names. To see the contents of a disk image, you must first open the disk image so it appears on the desktop or in a Finder window.

Features

Apple Disk Image files are published with a MIME type of application/x-apple-diskimage.

Different file systems can be contained inside these disk images, and there is also support for creating hybrid optical media images that contain multiple file systems. [1] Some of the file systems supported include Hierarchical File System (HFS), HFS Plus (HFS+), File Allocation Table (FAT), ISO9660, and Universal Disk Format (UDF). [1] [2]

Apple Disk Images can be created using utilities bundled with Mac OS X, specifically Disk Copy in Mac OS X v10.2 and earlier and Disk Utility in Mac OS X v10.3 and later. These utilities can also use Apple disk image files as images for burning CDs and DVDs. Disk image files may also be managed via the command line interface using the hdiutil utility. [3]

In Mac OS X v10.2.3, Apple introduced Compressed Disk Images [4] and Internet-Enabled Disk Images for use with the Apple utility Disk Copy, which was later integrated into Disk Utility in 10.3. The Disk Copy application had the ability to display a multilingual software license agreement before mounting a disk image. The image will not be mounted unless the user indicates agreement with the license. [5]

An Apple Disk Image allows secure password protection as well as file compression, and hence serves both security and file distribution functions; such a disk image is most commonly used to distribute software over the Internet.

History

Apple originally created its disk image formats because the resource fork used by Mac applications could not easily be transferred over mixed networks such as those that make up the Internet. Even as the use of resource forks declined with Mac OS X, disk images remained the standard software distribution format. Disk images allow the distributor to control the Finder's presentation of the window, which is commonly used to instruct the user to copy the application to the correct folder.

A previous version of the format, intended only for floppy disk images, is usually referred to as "Disk Copy 4.2" format, after the version of the Disk Copy utility that was used to handle these images. [1] A similar format that supported compression of floppy disk images is called DART. [1] [6]

New Disk Image Format (NDIF) was the previous default disk image format in Mac OS 9, [1] and disk images with this format generally have a .img (not to be confused with raw .img disk image files) or .smi file extension. Files with the .smi extension are actually applications that mount an embedded disk image, thus a "Self Mounting Image", intended only for Mac OS 9 and earlier. [7] [2]

Universal Disk Image Format (UDIF) is the native format disk image format for Mac OS X. Disk images in this format typically have a .dmg extension. [1]

File format

Apple has not released any documentation on the format, but attempts to reverse engineer parts of the format have been successful. The encrypted layer was reverse engineered in an implementation called VileFault (a spoonerism of FileVault). [8]

Apple disk image files are essentially raw disk images (i.e. contain block data) with some added metadata, optionally with one or two layers applied that provide compression and encryption. In hdiutil, these layers are called CUDIFEncoding and CEncryptedEncoding. [1]

UDIF supports ADC (an old proprietary compression format by Apple), zlib, bzip2 (as of Mac OS X v10.4), LZFSE (as of Mac OS X v10.11), [9] and lzma (as of macOS v10.15) compression internally.

Metadata

The UDIF metadata is found at the end of the disk image following the data. This trailer can be described using the following C structure. [10] All values are big-endian (PowerPC byte ordering)

typedefstruct{uint8_tSignature[4];// magic 'koly'uint32_tVersion;// 4 (as of 2013)uint32_tHeaderSize;// sizeof(this) =  512 (as of 2013)uint32_tFlags;uint64_tRunningDataForkOffset;uint64_tDataForkOffset;// usually 0, beginning of fileuint64_tDataForkLength;uint64_tRsrcForkOffset;// resource fork offset and lengthuint64_tRsrcForkLength;uint32_tSegmentNumber;// Usually 1, can be 0uint32_tSegmentCount;// Usually 1, can be 0uuid_tSegmentID;uint32_tDataChecksumType;// Data fork checksumuint32_tDataChecksumSize;uint32_tDataChecksum[32];uint64_tXMLOffset;              // Position of XML property list in fileuint64_tXMLLength;uint8_tReserved1[120];uint32_tChecksumType;// Master checksumuint32_tChecksumSize;uint32_tChecksum[32];uint32_tImageVariant;// Unknown, commonly 1uint64_tSectorCount;uint32_treserved2;uint32_treserved3;uint32_treserved4;}__attribute__((packed,scalar_storage_order("big-endian")))UDIFResourceFile;

The XML plist contains a blkx (blocks) key, with information about how the preceding data fork is allocated. The main data is stored in a base64 block, using tables identified by the magic 'mish'. This 'mish' structure contains a table about blocks of data and the position and lengths of each "chunk" (usually only one chunk, but compression will create more). [10] The data and resource fork information is probably inherited from NDIF.

Encryption

The encryption layer comes in two versions. Version 1 has a trailer at the end of the file, while version 2 (default since OS X 10.5) puts it at the beginning. Whether the encryption is a layer outside of or inside of the blkx metadata (UDIF) is unclear from reverse engineered documentation, but judging from the vfcrack demonstration it's probably outside. [8]

Utilities

There are few options available to extract files or mount the proprietary Apple Disk Image format. Some cross-platform conversion utilities are:

Most dmg files are unencrypted. Because the dmg metadata is found in the end, a program not understanding dmg files can nevertheless read it as if it was a normal disk image, as long as there is support for the file system inside. Tools with this sort of capacity include:

Tools with specific dmg support include:

See also

Related Research Articles

QuickTime is a discontinued extensible multimedia architecture created by Apple, which supports playing, streaming, encoding, and transcoding a variety of digital media formats. The term QuickTime also refers to the QuickTime Player front-end media player application, which is built-into macOS, and was formerly available for Windows.

Universal Disk Format (UDF) is an open, vendor-neutral file system for computer data storage for a broad range of media. In practice, it has been most widely used for DVDs and newer optical disc formats, supplanting ISO 9660. Due to its design, it is very well suited to incremental updates on both write-once and re-writable optical media. UDF was developed and maintained by the Optical Storage Technology Association (OSTA).

Hierarchical File System (HFS) is a proprietary file system developed by Apple Inc. for use in computer systems running Mac OS. Originally designed for use on floppy and hard disks, it can also be found on read-only media such as CD-ROMs. HFS is also referred to as Mac OS Standard, while its successor, HFS Plus, is also called Mac OS Extended.

rsync File synchronization protocol and software

rsync is a utility for transferring and synchronizing files between a computer and a storage drive and across networked computers by comparing the modification times and sizes of files. It is commonly found on Unix-like operating systems and is under the GPL-3.0-or-later license.

The resource fork is a fork or section of a file on Apple's classic Mac OS operating system, which was also carried over to the modern macOS for compatibility, used to store structured data along with the unstructured data stored within the data fork.

StuffIt is a discontinued family of computer software utilities for archiving and compressing files. Originally produced for the Macintosh, versions for Microsoft Windows, Linux (x86), and Sun Solaris were later created. The proprietary compression format used by the StuffIt utilities is also termed StuffIt.

MacBinary is a file format that combines the data fork and the resource fork of a classic Mac OS file into a single file, along with HFS's extended metadata. The resulting file is suitable for transmission over FTP, the World Wide Web, and electronic mail. The documents can also be stored on computers that run operating systems with no HFS support, such as Unix or Windows.

HFS Plus or HFS+ is a journaling file system developed by Apple Inc. It replaced the Hierarchical File System (HFS) as the primary file system of Apple computers with the 1998 release of Mac OS 8.1. HFS+ continued as the primary Mac OS X file system until it was itself replaced with the Apple File System (APFS), released with macOS High Sierra in 2017. HFS+ is also one of the formats supported by the iPod digital music player.

In a computer file system, a fork is a set of data associated with a file-system object. File systems without forks only allow a single set of data for the contents, while file systems with forks allow multiple such contents. Every non-empty file must have at least one fork, often of default type, and depending on the file system, a file may have one or more other associated forks, which in turn may contain primary data integral to the file, or just metadata.

<span class="mw-page-title-main">Disk Utility</span> Software for Apple macOS

Disk Utility is a system utility for performing disk and disk volume-related tasks on the macOS operating system by Apple Inc.

Disk Copy was the default utility for handling logical volume images in System 7 through Mac OS X 10.2. In later versions of macOS it has been replaced by DiskImageMounter for mounting the images and Disk Utility for creating them.

A hybrid disc is a disc, such as CD-ROM or Blu-ray, which contains multiple types of data which can be used differently on different devices. These include CD-ROM music albums containing video files viewable on a personal computer, or feature film Blu-rays containing interactive content when used with a PlayStation 3 game console.

The following tables compare general and technical information for a number of file systems.

<span class="mw-page-title-main">Time Machine (macOS)</span> Backup software application developed by Apple and distributed as part of macOS

Time Machine is the backup mechanism of macOS, the desktop operating system developed by Apple. The software is designed to work with both local storage devices and network-attached disks, and is most commonly used with external disk drives connected using either USB or Thunderbolt. It was first introduced in Mac OS X 10.5 Leopard, which appeared in October 2007 and incrementally refined in subsequent releases of macOS. Time Machine was revamped in macOS 11 Big Sur to support APFS, thereby enabling "faster, more compact, and more reliable backups" than were possible previously.

A sparse image is a type of disk image file used on macOS that grows in size as the user adds data to the image, taking up only as much disk space as stored in it. Encrypted sparse image files are used to secure a user's home directory by the FileVault feature in Mac OS X Snow Leopard and earlier. Sparse images can be created using Disk Utility.

Sidecar files, also known as buddy files or connected files, are computer files that store data which is not supported by the format of a source file.

Disk Drill is a data recovery utility for Windows and macOS developed by Cleverfiles. It was introduced in 2010, and is primarily designed to recover deleted or lost files from hard disk drives, USB flash drives and SSD drives with the help of Recovery Vault technology. While Disk Drill was originally exclusive to the Mac, a Windows version was released in 2015.

Apple File System (APFS) is a proprietary file system developed and deployed by Apple Inc. for macOS Sierra (10.12.4) and later, iOS 10.3, tvOS 10.2, watchOS 3.2, and all versions of iPadOS. It aims to fix core problems of HFS+, APFS's predecessor on these operating systems. APFS is optimized for solid-state drive storage and supports encryption, snapshots, and increased data integrity, among other capabilities.

References

  1. 1 2 3 4 5 6 7 8 "hdiutil(1) Mac OS X Manual Page". Archived from the original on 2016-05-14. Retrieved 2016-05-14.
  2. 1 2 "Mac OS X: Using Disk Copy disk image files". Archived from the original on 2013-12-19. Retrieved 2013-04-25.
  3. ↑ hdiutil(1)  –  Darwin and macOS General Commands Manual
  4. ↑ "Re: Some apps refuse to launch in 10.2.8! (OT, but very important)". Archived from the original on 2014-01-17.
  5. ↑ "Guides". Apple. Archived from the original on 2009-03-06. Retrieved 2010-10-27.
  6. ↑ "DART 1.5.3: Version Change History". Archived from the original on 2013-12-19. Retrieved 2013-04-25.
  7. ↑ "Software Downloads: Formats and Common Error Messages". Archived from the original on 2010-12-24. Retrieved 2009-05-06.
  8. 1 2 "VileFault". 2006-12-29. Archived from the original on 2007-01-09. Retrieved 2010-10-27.
  9. ↑ Michael Tsai (2015-10-07). "LZFSE Disk Images in El Capitan". mjtsai.com. Archived from the original on 2017-04-09. Retrieved 2017-04-09.
  10. 1 2 "Demystifying the DMG File Format". Archived from the original on 2013-03-17.
  11. ↑ "dmg2img". Archived from the original on 29 November 2010. Retrieved 2010-10-27.
  12. ↑ "DMGExtractor". catacombae.org. Archived from the original on 2011-01-02. Retrieved 2011-01-03.
  13. ↑ MacDrive Features / Boot Camp / System Requirements /. "MacDrive Home page". Mediafour. Archived from the original on 4 October 2010. Retrieved 2010-10-27.
  14. ↑ "How To Convert DMG To ISO in Windows, Linux & Mac". 21 June 2008. Archived from the original on 2010-03-07.
  15. ↑ "Convert DMG To ISO using PowerISO". 29 January 2009. Archived from the original on 2009-05-02. Retrieved 2009-02-15.
  16. ↑ "About TransMac for Windows". www.acutesystems.com.
  17. ↑ "Convert". www.winytips.com. winytips. 24 December 2018. Retrieved 5 May 2020.
  18. ↑ Olivia Dehaviland (2015-03-03). "Apple DMG Disk Image Viewer". DataForensics.org. Archived from the original on 2015-04-02. Retrieved 2015-03-10.
  19. ↑ "darling-dmg". darling-dmg. Retrieved 29 March 2015.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.