3.13. Disk Image Formats

Disk images are used in many places and for many purposes: emulation, CD/DVD mastering, backup, disk duplication, and software distribution. Many image formats are just plain sector-by-sector copies of the disk's data, and disktype can handle them without any special precautions. This section lists the formats that need special handling, because they omit unused space (creating a so-called sparse image), use compression, or have a special sector encoding.

3.13.1. Raw CD Images

The CD format has many layers. The uppermost layer provides 2048 byte sectors for storing computer data. Some CD mastering or duplication programs work one level below that (usually called "raw mode"), where a sector has 2352 bytes and includes the last level of error correction codes. The popular .bin/.cue CD image format often uses this raw-sector format.

disktype recognizes the raw-sector format using the syncronization bytes and mode information at the start of each sector. It automatically extracts the 2048 actual data bytes from each sector for file system analysis. disktype doesn't know or care about multiple tracks or sessions, but the current code seems to be sufficient even for (S)VCD disks.

3.13.2. Apple Disk Images

Apple has been using disk images for quite some time. Over that time, a wealth of different formats has accumulated. The manual page for the hdiutil(1) utility on Mac OS X lists the following:

UDRW  UDIF read/write image
UDRO  UDIF read-only image
UDCO  UDIF ADC-compressed image
UDZO  UDIF zlib-compressed image
UDBZ  UDIF bzip2-compressed image (OS X 10.4+ only)
UFBI  UDIF entire image with MD5 checksum
UDRo  UDIF read-only (obsolete format)
UDCo  UDIF compressed (obsolete format)
UDTO  DVD/CD-R master for export
UDxx  UDIF stub image
UDSP  SPARSE (growable with content)
RdWr  NDIF read/write image (deprecated)
Rdxx  NDIF read-only image (deprecated, but still usable on OS 9 and OS X)
ROCo  NDIF compressed image (deprecated)
Rken  NDIF compressed (obsolete format)
DC42  Disk Copy 4.2 image

Unfortunately, Apple is very secretive and doesn't publish the format specifications. Apparently, they fear a degradation in user experience, were third parties allowed to write alternative utilities for handling disk images. Some older formats use proprietary compression algorithms, although the latest compressed format (UDZO) uses zlib. Mac OS X has a library (DiskImages.framework) that handles the various formats using a nice plug-in architecture, but it is marked private and neither headers nor documentation are available.

The "Disk Copy 4.2" format is the oldest one. It is quite straightforward (no sparse blocks, no compression) and Apple provides sample code to read it. However, the format is long obsolete and (to my knowledge) was only used for floppies.

The NDIF ("New Disk Image Format") format was introduced with Disk Copy 6.0. NDIF is a dual-fork format, meaning that all meta-data is stored in the resource fork. This makes them fragile for cross-system transport. Various variants of the format allow for sparse images (only actually used sectors are present), compression, and self-mounting images. Some more information on the introduction of NDIF is available in TidBITS #339.

Later, Apple introduced the UDIF format, which is basically the same as an NDIF, but in a robust single-fork format. Actually, it is simply the concatenation of the data fork, the resource fork, and a 512 byte header, without any padding. disktype recognizes the magic of that header at the end of the file, but that's all it can do for now until the meta-data format is published. Detection may still work for the read-write and uncompressed read-only formats.

3.13.3. Linux cloop Images

The cloop format was designed for Linux Live CDs. A standard Linux file system is compressed in chunks, so that random read access is still possible without decompressing the whole image.

disktype currently only recognizes the signature of the cloop image. The contents of the image are not made accessible; this would require that disktype links with zlib.

3.13.4. Virtual PC Disk Images

The Virtual PC emulator / virtual machine has its own image format for the hard disks of the virtual PCs. There is a basic statically-sized format and a dynamic format that expands as data is written. Other types of disk images include differential images (for undoable drives), and pointers to existing disks or partitions.

I was able to deduce the format of the static and dynamic images from examples. disktype recognizes them and properly analyzes the contents. The other formats are recognized, but cannot be analyzed further because they don't contain a complete image. To my knowledge, all versions of Virtual PC (Mac or Windows) starting with version 4 use this image format.