Disk images are used in many places and for many purposes: emulation, CD/DVD mastering, backup, disk duplication, and software distribution. Many image formats are just plain sector-by-sector copies of the disk's data, and disktype can handle them without any special precautions. This section lists the formats that need special handling, because they omit unused space (creating a so-called sparse image), use compression, or have a special sector encoding.
The CD format has many layers. The uppermost layer provides 2048 byte sectors for storing computer data. Some CD mastering or duplication programs work one level below that (usually called "raw mode"), where a sector has 2352 bytes and includes the last level of error correction codes. The popular .bin/.cue CD image format often uses this raw-sector format.
disktype recognizes the raw-sector format using the syncronization bytes and mode information at the start of each sector. It automatically extracts the 2048 actual data bytes from each sector for file system analysis. disktype doesn't know or care about multiple tracks or sessions, but the current code seems to be sufficient even for (S)VCD disks.
Apple has been using disk images for quite some time. Over that time, a wealth of different formats has accumulated. The manual page for the hdiutil(1) utility on Mac OS X lists the following:
UDRW UDIF read/write image UDRO UDIF read-only image UDCO UDIF ADC-compressed image UDZO UDIF zlib-compressed image UDBZ UDIF bzip2-compressed image (OS X 10.4+ only) UFBI UDIF entire image with MD5 checksum UDRo UDIF read-only (obsolete format) UDCo UDIF compressed (obsolete format) UDTO DVD/CD-R master for export UDxx UDIF stub image UDSP SPARSE (growable with content) RdWr NDIF read/write image (deprecated) Rdxx NDIF read-only image (deprecated, but still usable on OS 9 and OS X) ROCo NDIF compressed image (deprecated) Rken NDIF compressed (obsolete format) DC42 Disk Copy 4.2 image
Unfortunately, Apple is very secretive and doesn't publish the format
specifications. Apparently, they fear a degradation in user experience,
were third parties allowed to write alternative utilities for handling
disk images. Some older formats use proprietary compression algorithms,
although the latest compressed format (UDZO) uses zlib.
Mac OS X has a library (DiskImages.framework)
that handles the various formats using a nice plug-in architecture,
but it is marked private and neither headers nor documentation are available.
The "Disk Copy 4.2" format is the oldest one. It is quite straightforward (no sparse blocks, no compression) and Apple provides sample code to read it. However, the format is long obsolete and (to my knowledge) was only used for floppies.
The NDIF ("New Disk Image Format") format was introduced with Disk Copy 6.0. NDIF is a dual-fork format, meaning that all meta-data is stored in the resource fork. This makes them fragile for cross-system transport. Various variants of the format allow for sparse images (only actually used sectors are present), compression, and self-mounting images. Some more information on the introduction of NDIF is available in TidBITS #339.
Later, Apple introduced the UDIF format, which is basically the same as an NDIF, but in a robust single-fork format. Actually, it is simply the concatenation of the data fork, the resource fork, and a 512 byte header, without any padding. disktype recognizes the magic of that header at the end of the file, but that's all it can do for now until the meta-data format is published. Detection may still work for the read-write and uncompressed read-only formats.
The cloop format was designed for Linux Live CDs. A standard Linux file system is compressed in chunks, so that random read access is still possible without decompressing the whole image.
disktype currently only recognizes the signature of the cloop image. The contents of the image are not made accessible; this would require that disktype links with zlib.
The Virtual PC emulator / virtual machine has its own image format for the hard disks of the virtual PCs. There is a basic statically-sized format and a dynamic format that expands as data is written. Other types of disk images include differential images (for undoable drives), and pointers to existing disks or partitions.
I was able to deduce the format of the static and dynamic images from examples. disktype recognizes them and properly analyzes the contents. The other formats are recognized, but cannot be analyzed further because they don't contain a complete image. To my knowledge, all versions of Virtual PC (Mac or Windows) starting with version 4 use this image format.