{"id":51595152,"url":"https://github.com/securityronin/dmg-forensic","last_synced_at":"2026-07-11T18:01:36.310Z","repository":{"id":370022528,"uuid":"1273223558","full_name":"SecurityRonin/dmg-forensic","owner":"SecurityRonin","description":"Apple Disk Image (DMG/UDIF) forensic library — read UDIF + sparse/sparsebundle images, audit koly-trailer integrity as graded findings. Pure Rust, no C deps.","archived":false,"fork":false,"pushed_at":"2026-07-08T00:05:00.000Z","size":144,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-08T01:10:00.219Z","etag":null,"topics":["apple","dfir","digital-forensics","disk-image","dmg","forensics","incident-response","macos","rust","sparse-image","udif"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-18T10:14:00.000Z","updated_at":"2026-07-08T00:05:04.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/dmg-forensic","commit_stats":null,"previous_names":["securityronin/dmg-forensic"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/dmg-forensic","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fdmg-forensic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fdmg-forensic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fdmg-forensic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fdmg-forensic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/dmg-forensic/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fdmg-forensic/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35370428,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apple","dfir","digital-forensics","disk-image","dmg","forensics","incident-response","macos","rust","sparse-image","udif"],"created_at":"2026-07-11T18:01:33.868Z","updated_at":"2026-07-11T18:01:36.298Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"[![Crates.io (dmg-core)](https://img.shields.io/crates/v/dmg-core.svg?label=dmg-core)](https://crates.io/crates/dmg-core)\n[![Crates.io (dmg-forensic)](https://img.shields.io/crates/v/dmg-forensic.svg?label=dmg-forensic)](https://crates.io/crates/dmg-forensic)\n[![Docs.rs](https://img.shields.io/docsrs/dmg-core)](https://docs.rs/dmg-core)\n[![Rust 1.85+](https://img.shields.io/badge/rust-1.85%2B-orange.svg)](https://www.rust-lang.org)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)\n[![Sponsor](https://img.shields.io/badge/sponsor-h4x0r-ea4aaa?logo=github-sponsors)](https://github.com/sponsors/h4x0r)\n\n[![CI](https://github.com/SecurityRonin/dmg-forensic/actions/workflows/ci.yml/badge.svg)](https://github.com/SecurityRonin/dmg-forensic/actions/workflows/ci.yml)\n[![Docs](https://img.shields.io/badge/docs-mkdocs-blue)](https://securityronin.github.io/dmg-forensic/)\n\n**Read and audit macOS Disk Images (DMG/UDIF) in pure Rust — a `Read + Seek` virtual disk with every block codec, plus a koly-trailer anomaly auditor. Zero C dependencies.**\n\nPoint it at a `.dmg` and get graded forensic findings from the structure a happy-path reader trusts blindly:\n\n```rust\nuse std::path::Path;\n\n// The differentiator: audit the koly trailer for tampering / corruption.\nfor a in dmg_forensic::audit_path(Path::new(\"evidence.dmg\"))? {\n    println!(\"[{:?}] {}: {}\", a.severity, a.code, a.note);\n}\n// [High] DMG-KOLY-XML-OUT-OF-BOUNDS: koly XML block-table range [..] runs past the file …\n# Ok::\u003c(), std::io::Error\u003e(())\n```\n\n## Two crates\n\n- **`dmg-core`** (imported as `dmg`) — the reader. `DmgReader` over any `Read + Seek`: locates the 512-byte `koly` trailer, parses the embedded XML plist block table (`blkx`/`mish`), and serves the virtual sector stream through `Read + Seek`, decompressing on demand. Every codec `hdiutil` emits — **ADC, zlib, bzip2, LZFSE, LZMA** — all pure Rust, no C bindings, fuzzed against malformed input. Also reads Apple **sparse images** — `SparseImageReader` (`.sparseimage`, `sprs`) and `SparseBundleReader` (`.sparsebundle`, the band-file bundle Sumuri RECON and Time Machine produce) — behind the same `Read + Seek` virtual-disk interface.\n- **`dmg-forensic`** — the analyzer. `audit_path` / `audit_reader` / `audit` parse the raw koly trailer (not the reader's normalized view) and emit graded `forensicnomicon` findings.\n\n```toml\n[dependencies]\ndmg-core = \"0.1\"       # the reader (import as `dmg`)\ndmg-forensic = \"0.1\"   # the koly-trailer auditor\n```\n\n## Reading the virtual disk\n\n```rust\nuse dmg::DmgReader;\nuse std::fs::File;\nuse std::io::{Read, Seek, SeekFrom};\n\nlet mut reader = DmgReader::open(File::open(\"disk.dmg\")?)?;\nprintln!(\"virtual disk: {} bytes\", reader.virtual_disk_size());\n\nlet mut sector = [0u8; 512];\nreader.read_exact(\u0026mut sector)?;        // first sector\nreader.seek(SeekFrom::Start(1 \u003c\u003c 20))?; // seek anywhere\n# Ok::\u003c(), dmg::DmgError\u003e(())\n```\n\nBecause `DmgReader` is `Read + Seek`, it drops straight into any partition or filesystem analyzer that accepts a reader.\n\n## Anomaly codes\n\n| Code | Severity | Meaning |\n|------|----------|---------|\n| `DMG-KOLY-SIGNATURE-INVALID` | High | trailer signature is not `koly` — not UDIF, or overwritten |\n| `DMG-KOLY-VERSION-UNEXPECTED` | Low | version field is not the documented 4 |\n| `DMG-KOLY-DATAFORK-OUT-OF-BOUNDS` | High | data-fork offset+length runs past the file end |\n| `DMG-KOLY-XML-OUT-OF-BOUNDS` | High | XML block-table offset+length runs past the file end |\n| `DMG-KOLY-TRAILER-TOO-SMALL` | High | file is smaller than a 512-byte koly trailer |\n\nEach finding is an observation (\"consistent with\", never a verdict) carrying the offending value + field as evidence.\n\n## Trust, but verify\n\nPanic-free by construction: every koly field is read through a bounds-checked reader (0 out of range, never a panic), every pointer is range-checked against the file length, and `audit_reader` never loads a multi-GB image — it seeks to the tail and reads only the 512-byte trailer. Codecs are validated against real `hdiutil`-produced DMGs, and a real Apple-made DMG audits clean. See the [validation](https://securityronin.github.io/dmg-forensic/validation/) writeup.\n\n---\n\n[Privacy Policy](https://securityronin.github.io/dmg-forensic/privacy/) · [Terms of Service](https://securityronin.github.io/dmg-forensic/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fdmg-forensic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Fdmg-forensic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fdmg-forensic/lists"}