Skip to content

Releases: kev365/xways-imageio-dmg

Release list

v0.1.0-beta — Apple DMG images in X-Ways Forensics

v0.1.0-beta — Apple DMG images in X-Ways Forensics Pre-release
Pre-release

Choose a tag to compare

View all tags
@kev365 kev365 released this 05 Sep 17:45
v0.1.0-beta
a6a351c

First public beta of ImageIO_DMG.dll, an Image I/O API plugin that lets X-Ways Forensics open Apple DMG (UDIF) disk images. X-Ways otherwise refuses compressed DMGs.

Install

  1. Download ImageIO_DMG.dll below and verify its SHA-256 against the .sha256 file beside it.
  2. Copy it into your X-Ways installation's x64\ folder — the one that holds ImageIOAFF4.dll if the Evimetry AFF4 reader is installed. The install root is silently ignored for 64-bit Image I/O plugins, and xtensions\ is the wrong API class.
  3. Start X-Ways and add a .dmg as you would any image. The first time the plugin is consulted in a session, X-Ways shows an "about to be executed" prompt — click OK.

Requires X-Ways Forensics 19.5 or later, the release that introduced the Image I/O API. Built and verified against 21.8 on Windows 11 x64. No runtime dependencies.

What it reads

  • All six UDIF chunk types: raw, zero-fill, ADC (UDCO), zlib (UDZO), bzip2 (UDBZ), LZFSE (ULFO) and LZMA (ULMO).
  • Block maps from the XML property list or a binary resource fork.
  • Whole-disk images (GPT / Apple partition map) and single-volume images.
  • Encrypted images (encrcdsa v2, AES-128/256), unlocked from a password prompt, the X-Ways Passwords.txt collection, an environment variable, or a DPAPI-encrypted per-user store.
  • Segmented images (.dmg plus .NNN.dmgpart), .sparseimage files, and .sparsebundle directories — including encrypted variants of each.

Declined with a message rather than opened wrongly: NDIF / Disk Copy images, legacy cdsaencr v1 encryption, and images protected only by a certificate or keybag.

Forensic behaviour

  • The image file is opened read-only and is never written to.
  • A chunk that cannot be decoded is presented as zeros, never as a silent short read, and is reported in the X-Ways Messages window and in a per-image report file next to the DLL. Anything shown in those ranges, and any hash covering them, reflects zeros rather than evidence.
  • The CRC32 checksums a UDIF image carries — per partition, over the data fork, and over the partition checksums — can be verified. Set IMAGEIO_DMG_VERIFY to check every image as it is opened.

Verification

Every image in the test corpus extracts byte-identically to hdiutil's own raw copy of the same volume, third-party producers included: Firefox (built on Linux with libdmg-hfsplus rather than hdiutil) and the 1.5 GB LibreOffice images. A mutation fuzzer ran 12,650 corrupted inputs through the reader with zero crashes and zero hangs.

See the README for full documentation.

This is a beta. The whole 0.x series carries the -beta suffix; 1.0.0 will be the first API-stable release. When reporting a problem, please include dmgtest map output rather than evidence images.

MIT licensed. An unofficial community project: X-Ways and X-Ways Forensics are trademarks of X-Ways Software Technology AG.

Loading