Expand description
Pure-Rust forensic Apple Disk Image (DMG/UDIF) reader.
A DMG file uses the UDIF (Universal Disk Image Format) container:
- 512-byte koly trailer at the very end of the file (all big-endian)
- XML plist at
xml_offsetcontaining partition block tables (blkxarray) - Each blkx
Datafield is a base64-encoded mish block describing how virtual sectors map to data in the file
Supported block types: zero (0x00), raw (0x01), ignore (0x02), ADC
(0x80000004), zlib/UDZO (0x80000005), bzip2/UDBZ (0x80000006),
LZFSE/ULFO (0x80000007), and LZMA/ULMO (0x80000008) — every codec
hdiutil emits. All decoders are pure Rust (no C dependencies).
Structs§
- DmgReader
- Read-only Apple DMG (UDIF) reader implementing
Read + Seek.
Enums§
- DmgError
- Errors returned by
DmgReader.