.DMG File Format – Sparse and segmented images

Apple disk image

Not every Apple disk image is one UDIF file. This page covers the sparse forms, images split into segments, and the older NDIF format. The sparse image layout comes from the libmodi project’s documentation; no real sparse image was available to compare it with, so it was checked only against hand-built files.

Sparse images (.sparseimage)

A sparse image grows as data is written to the disk. The disk is cut into bands of a fixed size, and a band is stored in the file only once something has been written to it, in the order the bands were first written. Numbers are big-endian.

  1. 0Signature sprs4 bytes
  2. 4Fields version and sizes60 bytes
  3. 64Band table one 32-bit entry for each stored bandto byte 4096
  4. 4096Bands one after anothervaries
The layout of a sparse image.
OffsetSizeField
04Signature, sprs
44Version; 3 is the value seen
84Sectors per band (512 bytes each)
124Not documented
164The disk’s size, in sectors
2044Not documented
644032Band table

Entry n of the band table says which band of the disk is stored at file offset 4096 + n × band size. Bands are numbered from 1, and 0 marks an empty slot. A band with no entry reads as zeros.

Sparse bundles (.sparsebundle)

A sparse bundle is a folder, not a file: an Info.plist and its copy Info.bckup, an empty token file, and a bands folder with one file for each band, named with its number in hexadecimal. The Info.plist gives the band size and the disk’s size. The explorer opens one file at a time, so a bundle cannot be read yet.

Segmented images

A UDIF image can be split into several files, named .dmg, .002.dmgpart, .003.dmgpart and so on. Each has its own koly trailer, with its segment number and the number of segments. In a segment, the running data fork offset says where that file’s data starts within the data of the whole image, and the block tables’ compressed offsets count across all the segments.

One segment read alone gives the runs stored in it. The rest are in other files. The explorer opens one file at a time, so it reports the other segments’ runs as stored elsewhere.

NDIF

New Disk Image Format is the format before UDIF, usually with the extension .img or .smi. Its data fork holds the sectors, and its block map is in a resource fork. A browser is given a file’s data fork alone, and that holds no signature to identify NDIF by: a data fork in NDIF cannot be told from raw data, so the explorer can only say the file is not UDIF.