Apple Disk Image (DMG)
| Format | Apple Disk Image (DMG) |
|---|---|
| Short name | DMG |
| Category | disk_image |
| Platforms | macOS |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Apple disk image format. A UDIF image consists of data blocks (raw or compressed with ADC, zlib, bzip2, LZFSE or LZMA), an XML property list holding the block map, and a 512-byte 'koly' trailer at EOF instead of a file header; raw images can lack the trailer. Typically contains an HFS+, APFS, FAT32 or ExFAT filesystem. Can be AES-128 or AES-256 encrypted with a password or a certificate; an encrypted image begins 'encrcdsa' (version 2) or ends with 'cdsaencr' (version 1), and the 'koly' trailer is then inside the encrypted data. Variants: segmented UDIF (.dmgpart), sparse image (.sparseimage, header 'sprs', blocks allocated as written), sparse bundle (.sparsebundle, a folder of band files). Common as a software installer (Downloads folders), as user-created encrypted containers, as the storage of Time Machine backups to network destinations (sparse bundle), and as a preferred acquisition format for macOS devices (SWGDE).
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | 6B 6F 6C 79 | koly | UDIF 'koly' trailer block at EOF-512 (no file header magic) |
| offset 0 (0x0) | 65 6E 63 72 63 64 73 61 | encrcdsa | Encrypted disk image, version 2 header |
| offset unknown | 63 64 73 61 65 6E 63 72 | cdsaencr | Encrypted disk image, version 1 marker in the last 8 bytes |
| offset 0 (0x0) | 73 70 72 73 | sprs | Sparse image (.sparseimage) header |
Known extensions
.dmg, .sparseimage, .sparsebundle
References
- Mac OS disk image types — format documentation (libyal/libmodi) https://github.com/libyal/libmodi/blob/main/documentation/Mac%20OS%20disk%20image%20types.asciidoc
- DMG format reverse-engineered (newosxbook.com) https://newosxbook.com/DMG.html
- Encrypted DMG header versions — dmg2john (John the Ripper) https://github.com/openwall/john/blob/bleeding-jumbo/run/dmg2john.py
- Apple Disk Image (Wikipedia — UDIF structure) https://en.wikipedia.org/wiki/Apple_Disk_Image
- ForensicsWiki — DMG https://forensics.wiki/dmg/
- SWGDE Best Practices macOS Forensic Acquisition https://www.swgde.org/documents/published-complete-listing/23-f-005-swgde-best-practices-apple-macos-forensic-acquisition/
Cite this entry
Crush Format Reference, “Apple Disk Image (DMG)”. https://kalink0.github.io/crush-forensics/formats/dmg/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction