Skip to content

Add Apple Disk Image (DMG) support - #88

Open
joost-j wants to merge 1 commit into
fox-it:mainfrom
joost-j:feature/dmg
Open

Add Apple Disk Image (DMG) support#88
joost-j wants to merge 1 commit into
fox-it:mainfrom
joost-j:feature/dmg

Conversation

@joost-j

@joost-j joost-j commented Aug 4, 2026

Copy link
Copy Markdown

Add support for .dmg files containing the UDIF file format. Some macOS acquisition tools, for example Fuji, are able to create DMG outputs. This PR enables users to directly interact with those resulting disk images without needing to convert them first. Supports the different sub-formats, as well as encrypted DMG's.

I've been thinking about committing this code to the dissect.disc repo first, but since that is specifically targeting filesystems for optical media, I figured this repository is a better fit. DMG does not have it's own filesystem and is mainly a wrapper around a disk, much like other formats in this repo (e.g. vmdk/vhd). If this code belongs in another dissect project, please let me know.

Test data was created manually on a MacBook with the hdiutil tool and converted to the individual sub-formats. The code was generated with Claude Code and manually reviewed / edited to fit the dissect code base; this greatly contributed to the completeness of the implementation, as well as the time to get it done. So if you were wondering why the docstrings and struct annotations are so detailed; that's why. Any feedback with regards to the use of Claude Code is also appreciated.

Requires fox-it/dissect.util#131 for the ADC compression.

@joost-j joost-j changed the title Add Apple Disk Image (DMG) container Add Apple Disk Image (DMG) support Aug 4, 2026
@Schamper

Schamper commented Aug 4, 2026

Copy link
Copy Markdown
Member

What about dissect.archive? I know it's all "what's in a name" in the end, but, you know.

@joost-j

joost-j commented Aug 4, 2026

Copy link
Copy Markdown
Author

Yes that could also be an option, though most of the implementations in dissect.archive function as a basis for filesystem implementations and not really raw disks; there isn't a single container in dissect.target which uses a container from dissect.archive.

One could argue that DMG (in terms of vendor/basic capabilities) comes close to the ASIF file format, which was placed in this repo as well. However, ASIF is actually used for virtualization purposes, as opposed to DMG. EWF/ASDF are also very similar, but DMG lacks the forensic evidence features. A third option would be a separate dissect.diskimage or something alike which will hold ASIF/DMG, but that's overkill maybe.

Though it's not a clean fit, my choice would still be this repo but I'll let you make the call.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants