You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add support for .dmg files containing the UDIF file format. Some macOS acquisition tools, for example Fuji, are able to create DMG outputs. This PR enables users to directly interact with those resulting disk images without needing to convert them first. Supports the different sub-formats, as well as encrypted DMG's.
I've been thinking about committing this code to the dissect.disc repo first, but since that is specifically targeting filesystems for optical media, I figured this repository is a better fit. DMG does not have it's own filesystem and is mainly a wrapper around a disk, much like other formats in this repo (e.g. vmdk/vhd). If this code belongs in another dissect project, please let me know.
Test data was created manually on a MacBook with the hdiutil tool and converted to the individual sub-formats. The code was generated with Claude Code and manually reviewed / edited to fit the dissect code base; this greatly contributed to the completeness of the implementation, as well as the time to get it done. So if you were wondering why the docstrings and struct annotations are so detailed; that's why. Any feedback with regards to the use of Claude Code is also appreciated.
Yes that could also be an option, though most of the implementations in dissect.archive function as a basis for filesystem implementations and not really raw disks; there isn't a single container in dissect.target which uses a container from dissect.archive.
One could argue that DMG (in terms of vendor/basic capabilities) comes close to the ASIF file format, which was placed in this repo as well. However, ASIF is actually used for virtualization purposes, as opposed to DMG. EWF/ASDF are also very similar, but DMG lacks the forensic evidence features. A third option would be a separate dissect.diskimage or something alike which will hold ASIF/DMG, but that's overkill maybe.
Though it's not a clean fit, my choice would still be this repo but I'll let you make the call.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add support for
.dmgfiles containing the UDIF file format. Some macOS acquisition tools, for example Fuji, are able to create DMG outputs. This PR enables users to directly interact with those resulting disk images without needing to convert them first. Supports the different sub-formats, as well as encrypted DMG's.I've been thinking about committing this code to the
dissect.discrepo first, but since that is specifically targeting filesystems for optical media, I figured this repository is a better fit. DMG does not have it's own filesystem and is mainly a wrapper around a disk, much like other formats in this repo (e.g.vmdk/vhd). If this code belongs in another dissect project, please let me know.Test data was created manually on a MacBook with the
hdiutiltool and converted to the individual sub-formats. The code was generated with Claude Code and manually reviewed / edited to fit the dissect code base; this greatly contributed to the completeness of the implementation, as well as the time to get it done. So if you were wondering why the docstrings and struct annotations are so detailed; that's why. Any feedback with regards to the use of Claude Code is also appreciated.Requires fox-it/dissect.util#131 for the ADC compression.