Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Universal Disk Image Format (UDIF)

The Universal Disk Image Format (UDIF) (.dmg) is one of the disk image formats supported natively by Mac OS.

Overview

Known UDIF image types are:

IdentifierDescription
UDBZbzip2 compressed UDIF
UDCOApple Data Compression (ADC) compressed UDIF
UDIFRead-write uncompressed UDIF
UDRORead-only uncompressed UDIF
UDxxUncompressed UDIF
UDZOzlib/DEFLATE compressed UDIF
ULFOLZFSE compressed UDIF
ULMOLZMA compressed UDIF

UDIF images are either uncompressed or compressed.

Uncompressed image format

An uncompressed UDIF image consist of:

  • data
  • optional file footer

Note that an uncompressed UDIF image without file footer is equivalent to a RAW storage media image (CRawDiskImage).

Compressed image format

A compressed UDIF image consist of:

  • Data fork
  • Optional resource fork
  • Optional XML plist
  • File footer the end of the image file

Characteristics

CharacteristicsDescription
Byte orderbig-endian
Date and time valuesN/A
Character stringsN/A

The number of bytes per sector is 512.

The file footer (also known as resource file or metadata) is 512 bytes in size and consists of:

OffsetSizeValueDescription
04"koly"Signature
444Format version
84512File footer size in bytes
124Image flags
168Unknown (RunningDataForkOffset)
248Data fork offset, where the offset is relative from the start of the image file
328Data fork size
408Resource fork offset, where the offset is relative from the start of the image file
488Resource fork size
564Unknown (SegmentNumber)
604Number of segments, which contains 0 if not set
6416Segment identifier, which contains an UUID
804Data checksum type
844Data checksum size, as number of bits
88128Data checksum
2168XML plist offset, where the offset is relative from the start of the image file
2248XML plist size
232120Unknown (Reserved)
3524Master checksum type
3564Master checksum size, as number of bits
360128Master checksum
4884Image type (or variant)
4928Number of sectors
5004Unknown (reserved)
5044Unknown (reserved)
5084Unknown (reserved)

Note that the XML plist size can be 0, such as in an UDIF stub (UDxx) image.

Image flags

ValueIdentifierDescription
0x00000001kUDIFFlagsFlattenedUnknown (flattened?)
0x00000004kUDIFFlagsInternetEnabledUnknown (internet enabled?)

Image types

ValueIdentifierDescription
1kUDIFDeviceImageTypeDevice image
2kUDIFPartitionImageTypeParitition image

XML plist

TODO: complete section

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>resource-fork</key>
    <dict>
        <key>blkx</key>
        <array>
            <dict>
                <key>Attributes</key>
                <string>0x0050</string>
                <key>CFName</key>
                <string>Protective Master Boot Record (MBR : 0)</string>
                <key>Data</key>
                <data>
                bWlzaAAAAAEAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAA
                AAgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAIAAAAgQfL6MwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAACgAAABQAAAAMAAAAAAAAAAAAAAAAAAAABAAAA
                AAAAIA0AAAAAAAAAH/////8AAAAAAAAAAAAAAAEAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAA=
                </data>
                <key>ID</key>
                <string>-1</string>
                <key>Name</key>
                <string>Protective Master Boot Record (MBR : 0)</string>
            </dict>
            ...
        </array>
        <key>plst</key>
        <array>
            <dict>
                <key>Attributes</key>
                <string>0x0050</string>
                <key>Data</key>
                <data>
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAQAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
                AAAAAAAAAAAA
                </data>
                <key>ID</key>
                <string>0</string>
                <key>Name</key>
                <string></string>
            </dict>
        </array>
    </dict>
</dict>
</plist>

The XML plist contains the following key-value pairs:

IdentifierDescription
resource-forkdictionary

XML plist resource-fork dictionary

The resource-fork dictionary contains the following key-value pairs:

IdentifierDescription
blkxarray of dictionaries
plstarray of dictionaries

XML plist blkx array entry

A blkx array entry contains the following key-value pairs:

IdentifierDescription
Attributesstring that contains a hexadecimal formatted integer value
CFNamestring
Datastring that contains base-64 encoded data of a block table
IDstring that contains a decimal formatted integer value
Namestring

Block table

The block table (BLKXTable) is of variable size and consists of:

  • block table header
  • block table entries

The block table header

The block table header is 204 bytes in size and consists of:

OffsetSizeValueDescription
04"mish"Signature
441Format version
88Start sector, which contains the sector number relative to the start of the media data
168Number of sectors
248Unknown (DataOffset), which seems to be always 0
324Unknown (BuffersNeeded)
364Unknown (BlockDescriptors). Does this value correspond to the number of block table entries?
4040Unknown (reserved)
4440Unknown (reserved)
4840Unknown (reserved)
5240Unknown (reserved)
5640Unknown (reserved)
6040Unknown (reserved)
644Checksum type
684Checksum size
72128Checksum
2004Number of entries

Block table entry

The block table entry (BLKXChunkEntry) is 40 bytes in size and consists of:

OffsetSizeValueDescription
04Entry type
44Unknown (comment)
88Start sector, which contains the sector number relative to the start of the start sector of the block table
168Number of sectors
248Data offset, which contains the byte offset relative to the start of the UDIF image file
328Data size, which contain the number of bytes of data stored, which is 0 for sparse data

UDIF block table entry types

ValueIdentifierDescription
0x00000000Unknown (sparse)
0x00000001Uncompressed (raw) data
0x00000002Sparse (used for Apple_Free)
0x7ffffffeComment
0x80000004ADC compressed data
0x80000005zlib compressed data
0x80000006bzip2 compressed data
0x80000007LZFSE compressed data
0x80000008LZMA compressed data
0xffffffffBlock table entries terminator

UDIF comment

TODO: complete section

UDIF data fork

TODO: complete section

UDIF resource fork

TODO: complete section

Notes

Is the maximum compressed chunk size 2048 sectors?

Comment seems to reference compressed data but has no size or number of sectors value.