May 7th, 2011
Apple Disk Image is a disk image format commonly used by the macOS operating system. When opened, an Apple Disk Image is mounted as a volume within the Macintosh Finder. An Apple Disk Image can be structured according to one of several proprietary disk image formats, including the Universal Disk Image Format (UDIF) from Mac OS X and the New Disk Image Format (NDIF) from Mac OS 9. Apple questions and answers. Home; Home Imac Duel Monitor help. Imac; Duel Monitor help. February 22, 2021. I'm looking for some help as I'm new to duel monitors. I have an iMac 27' but for logistics of space in the office it is on the.
Never
Not a member of Pastebin yet?Sign Up, it unlocks many cool features!
- Format Description: UDIF read-only compressed (zlib)
- Checksum Type: CRC32
- Compressed Ratio: 0.59470938353466807
- Sector Count: 287321834
- CUDIFEncoding-bytes-wasted: 0
- CUDIFEncoding-bytes-in-use: 65634945181
- CUDIFEncoding-bytes-total: 65634945181
- Segments:
- Partition Information:
- Name: whole disk (Windows_NTFS : 0)
- Checksum Type: CRC32
- Format: UDZO
- URL: file://localhost/private/var/root/windows.dmg
- Class Name: CUDIFEncoding
- URL: file://localhost/private/var/root/windows.dmg
- Class Name: CBSDBackingStore
- partition-scheme: none
- appendable: false
- 0:
- partition-start: 0
- partition-length: 287321834
- partition-filesystems:
- burnable: false
- Properties:
- Kernel Compatible: false
- Software License Agreement: false
- Compressed: true
- 287321834 287321834 287321834
RAW Paste Data
Introduction
Several utilities (first of all the Disk utility and hdiutil) can be used on theMacintosh to produce and manage disk images. Those disk images exist in severalformats, some of them being declared as obsolete (for instance the images of floppydisks).
Disk images can be real images of real disks, that is a plain copy, sector aftersector, of the real contents of the disk. They can also be containers used asvirtual disks, handled and managed like a real disk, but holding for instancethe contents of a specific folder.
For this reason, disk images are very often used to distribute softwarepackages.
Disk images can be real images of real disks, that is a plain copy, sector aftersector, of the real contents of the disk. They can also be containers used asvirtual disks, handled and managed like a real disk, but holding for instancethe contents of a specific folder.
For this reason, disk images are very often used to distribute softwarepackages.
Image Formats
The Disk Utility software allows to produce several kinds of empty images. Themots interesting are the so called MBR. The sector 0 contains a classical MBR,with the 0xAA55 signature at the end. The system code is 0xAF. The whole imageis formatted according the so-called floppy mode (that is, without a partitiontable, volume header in sector 2).
It is also possible to produce an EFI/GPT image. This image uses the same MBRscheme, but the system code is this time 0xEE. This sector 0 is followed bya classical GUID partition table (see theWiki page for moreinformation.
On the other hand, following list is given in the hdiutil manual page:
It is also possible to produce an EFI/GPT image. This image uses the same MBRscheme, but the system code is this time 0xEE. This sector 0 is followed bya classical GUID partition table (see theWiki page for moreinformation.
On the other hand, following list is given in the hdiutil manual page:
UDRW - UDIF read/write image
UDRO - UDIF read-only image
UDCO - UDIF ADC-compressed image
UDZO - UDIF zlib-compressed image
UDBZ - UDIF bzip2-compressed image (OS X 10.4+ only)
UFBI - UDIF entire image with MD5 checksum
UDRo - UDIF read-only (obsolete format)
UDCo - UDIF compressed (obsolete format)
UDTO - DVD/CD-R master for export
UDxx - UDIF stub image
UDSP - SPARSE (grows with content)
RdWr - NDIF read/write image (deprecated)
Rdxx - NDIF read-only image (Disk Copy 6.3.3 format)
ROCo - NDIF compressed image (deprecated)
Rken - NDIF compressed (obsolete format)
DC42 - Disk Copy 4.2 image
Uncompressed Formats
Beside the last five formats, which are clearly of historical nature, the UDRWimage (UDIF read/write image) and the UDTO image (DVD/CD-R master for export)are uncompressed formats, that is plain images of a real or virtual disk. They canbe opened by utilities like our MacImage and canbe mounted under Linux, etc.
The UDSP format is an image where all the space occupied by the disk is not yetallocated. Those so-called sparse images and files are a quite different matterand we won't go further here.
The UDSP format is an image where all the space occupied by the disk is not yetallocated. Those so-called sparse images and files are a quite different matterand we won't go further here.
Compressed Formats
The compressed disk images use several compression schemes, from the simpliest,where sectors containing nothing but zeros are not copied to the compressedfile, to the highly sophisticated, using some of the best compression schemes,but always with a cost: it takes time.
A good compromise must be found between the time used for the compression, thetime used for the decompression and the space taken by the image on a storagedisk.
A good compromise must be found between the time used for the compression, thetime used for the decompression and the space taken by the image on a storagedisk.
General Layout
In the compressed images, one can find three different parts: Apple hfs driver for windows.
- Data
- Block Table
- 'koly' Binary Block
The data part and the table can have a variable length. On the other hand, thebinary block, at the very end of the file, has a fixed length of 512 bytes. What to do when you forgot your macbook password.
Apple Udif Read-only Compressed (bzip2)
'koly' Binary Block
The 'koly' binary block is called by this name because it contains the 'koly'signature in the first 32-bit integer. This block often contains many parasiticdata remnants because the buffer was not cleared before writing the pertinentdata in it. However, one can easily observe that there are two int64 integersholding the offset of the Block Table in the compressed file, after the secondone an other int64 integer holding the length of this table. At the end of the block,one can easily note the CRC32 of the image and, a bit further, the number of thesectors in the plain image.
I don't know the meaning of the few first int32 integers, but I think it couldbe the number of the partitions, the size of the sectors, etc.
I don't know the meaning of the few first int32 integers, but I think it couldbe the number of the partitions, the size of the sectors, etc.
![Compressed Compressed](https://preview.redd.it/4ex4mrz6so221.png?width=854&format=png&auto=webp&s=7cd8540d94aa62d101434a140263b0878627d419)
Block Table
The Block Table is stored in an XML file which is often called the plist file,because it uses the format often used on the Macintosh for the preference lists.It is also called 'resource-fork' file because this string is present in thefile.
One should note that a XML data segment in a data file should not be called aresource fork, but this is the way it is. Let's go further.
The Block Table contains several data runs, generally four, but I already observeda disk image with a single meaningful data run and a second empty one. Those dataruns are stored between <data> and </data> tags. In the case of a disk image froma Macintosh disk or folder, we have generally four data runs, also called partitionsin the XML file.
One should note that a XML data segment in a data file should not be called aresource fork, but this is the way it is. Let's go further.
The Block Table contains several data runs, generally four, but I already observeda disk image with a single meaningful data run and a second empty one. Those dataruns are stored between <data> and </data> tags. In the case of a disk image froma Macintosh disk or folder, we have generally four data runs, also called partitionsin the XML file.
- Driver Descriptor Map
- Partition Table
- Apple_HFS Partition
- Apple_Free Partition
The first so-called partition contains the sector 0 of the disk. The PartitionTable contains the sector 1 and so on, up to the volume header block. The Apple_HFSpartition contains the useful contents of the image. The Apple_Free Partitioncontains the few last free sectors of the disk image.
Those data runs are stored in the XML file as base64 coded sequences. For moreinformation on the base64 coding scheme, see for instance theWikipedia page.
After decoding, those data runs appear as a header block of 204 bytes, beginningwith the 'mish' signature, followed by blocks of 40 bytes, one for eachcompressed data segment in the Data part of the image. The structure of thisbloc is following:
Those data runs are stored in the XML file as base64 coded sequences. For moreinformation on the base64 coding scheme, see for instance theWikipedia page.
After decoding, those data runs appear as a header block of 204 bytes, beginningwith the 'mish' signature, followed by blocks of 40 bytes, one for eachcompressed data segment in the Data part of the image. The structure of thisbloc is following:
- Block Type (32 bits)
- Flags?? (32 bits)
- Result Offset (64 bits)
- Result Size (64 bits)
- Input Offset (64 bits)
- Input Size (64 bits)
This block allows to manage the data segments. The block types identified so farare following:
- 0x00000000 - Block of zeroes
- 0x00000001 - Block of stored data
- 0x00000002 - Block of zeroes
- 0x80000004 - Block compressed with the ADC scheme
- 0x80000005 - Block compressed with the Zlib scheme
- 0x80000006 - Block compressed with the BZlib2 scheme
- 0x7FFFFFFE - Mysterious block, to be ignored
- 0xFFFFFFFF - End Marker of a run of blocks
Information Sources
To gather, analyze and pinpoint the informations given above, we spent mainlytime looking at real images produced by Disk utility and hdiutil. This allowedus to identify rather rapidly the Zlib and Bzlib compression schemes and tofind libraries which implement those schemes, namely Zlib.net,library written by Jean-Loup Gailly and Mark Adler, andBzlib.org, library written by Julian Seward.I want to thank them warmly for their work and all informations given in theircode.
Several welcome confirmations and some precisions were found in the librariesdmg2iso and dmg2img, diffused on the site vultur.eu.organd written by Vu1tur and Jean-Pierre Demailly.
The hardest and longest part was the decoding of the ADC compression scheme.It seems that there is no official documentation available on the Web. Nevertheless,I could get working code written in a couple of days.
Several welcome confirmations and some precisions were found in the librariesdmg2iso and dmg2img, diffused on the site vultur.eu.organd written by Vu1tur and Jean-Pierre Demailly.
The hardest and longest part was the decoding of the ADC compression scheme.It seems that there is no official documentation available on the Web. Nevertheless,I could get working code written in a couple of days.
![Apple Udif Read Only Compressed Apple Udif Read Only Compressed](https://wiki.education.ucsb.edu/wiki/images/thumb/8/82/Disk_Utility_Device.png/300px-Disk_Utility_Device.png)
ADC Compression Scheme
The ADC (Apple Data Compression) scheme relies on both run length coding andpointing to data in a sliding dictionary. The best way to explain the scheme isto express it as pseudo-code:
How To Delete Apple Udif Read-only Compressed (
Read a byte.
If bit 7 is set, this is a data run, whose length is the rest of the bits, plusone.Copy to the target buffer.If bit 6 is set, this is a three-byte code.Strip the bit 6 and add 4 to get the length. The following twobytes code the offset of the data to be used. This offset is computed backwardsfrom the target pointer. Put a offset pointer to this address. If the differencebetween the offset pointer and the target pointer is large enough to hold the datalength, just do a plain copy from the offset pointer to the target pointer. Ifnot, use memset or the like to copy n times a single byte at the targetpointer.If none is set, this is a two-byte code.The length is coded in bits 2345 andthe offset is coded in bits 01 of the first byte and in the other byte. Add 3to the length (that is, 0000 codes 3, 0001 4, and so on). Like in the three-bytecodes, depending on the difference between the offset pointer and the targetpointer, use memcpy or memset.As long as there is still data to decode.
Which Tools to Manage Such Files on a PC?
Our MacImage utility can managesuch image files (decompress them, display their content to copy some files, etc.).