Expand description
Pure-Rust forensic Apple Disk Image (DMG/UDIF) reader.
A DMG file uses the UDIF (Universal Disk Image Format) container:
- 512-byte koly trailer at the very end of the file (all big-endian)
- XML plist at
xml_offsetcontaining partition block tables (blkxarray) - Each blkx
Datafield is a base64-encoded mish block describing how virtual sectors map to data in the file
Supported block types: zero (0x00), raw (0x01), ignore (0x02), zlib (0x80000005).
bzip2 (0x80000006) and LZFSE (0x80000007) return NotSupported.
Structs§
- DmgReader
- Read-only Apple DMG (UDIF) reader implementing
Read + Seek.
Enums§
- DmgError
- Errors returned by
DmgReader.