dissect.hypervisor.disk.asif

Module Contents

Classes

ASIF

Apple Sparse Image Format (ASIF) disk image.

Directory

ASIF Directory.

Table

ASIF Table.

DataStream

Stream to read data from an ASIF image.
class dissect.hypervisor.disk.asif.ASIF(fh: BinaryIO)

Apple Sparse Image Format (ASIF) disk image.

ASIF disk images are a virtual disk format introduced in macOS Tahoe. They can be used in Apple’s Virtualization framework, as well as through Disk Utility.

An ASIF file is pretty straight forward. There’s a small header which, among some other details, contains two directory offsets. Each directory contains a list of tables, which in turn contain a list of data entries. Each data entry points to a chunk of data in the ASIF file. The chunk size is defined in the header and is typically 1 MiB. The chunk size is always a multiple of the block size, which is also defined in the header (typically 512 bytes). Each directory has a version number, and the directory with the highest version number is the active directory. This allows for atomic updates of the directory/table data.

The maximum virtual disk size seems to be just under 4 PiB, with a small portion at the end reserved for metadata. The actual size of the virtual disk is defined in the header, as well as the maximum size the disk can grow to.

The offset to the metadata block is typically (4 PiB - 1 chunk), meaning it’s within the reserved area. The metadata block contains a small header and a plist. The plist should contain an internal metadata and user metadata dictionary. Besides a “stable uuid”, it’s unclear what the metadata is used for or how to set it.

Parameters:

fh – File-like object containing the ASIF image.

Resources:
fh
header
guid
block_size
chunk_size
size
max_size
directories
active_directory
metadata_header = None
metadata: dict[str, Any]
property internal_metadata: dict[str, Any]

Get internal metadata from the ASIF image.

Returns:

A dictionary containing the internal metadata.

property user_metadata: dict[str, Any]

Get user metadata from the ASIF image.

Returns:

A dictionary containing the user metadata.

open(reserved: bool = False) → DataStream

Open a stream to read the ASIF image data.

Parameters:

reserved – Whether to allow reading into the reserved area of the ASIF image.

Returns:

A stream-like object that can be used to read the image data.

class dissect.hypervisor.disk.asif.Directory(asif: ASIF, offset: int)

ASIF Directory.

A directory has a version (uint64) followed by a list of table entries (uint64[]). The version number is used to determine the active directory, with the highest version being the active one. Each table entry is a chunk number and points to a table in the ASIF image.

Parameters:

  • asif – The ASIF image this directory belongs to.

  • offset – Offset of the directory in the ASIF image.

asif
offset
version
table
__repr__() → str
property entries: list[int]

List of table entries in the directory.

class dissect.hypervisor.disk.asif.Table(directory: Directory, index: int)

ASIF Table.

A table contains a list of data entries (uint64[]). Each data entry is a chunk number and points to a chunk of data in the ASIF image. Each table covers a fixed amount of data in the virtual disk.

Data entries have 55 bits usable for the chunk number and 9 bits reserved for flags.

Encoding

0b00000000 01111111 11111111 11111111 11111111 11111111 11111111 11111111  (chunk number)
0b00111111 10000000 00000000 00000000 00000000 00000000 00000000 00000000  (reserved)
0b01000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000  (entry dirty)
0b10000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000  (content dirty)
Parameters:

  • directory – The directory this table belongs to.

  • index – Index of the table in the directory.

asif
directory
index
offset
virtual_offset
__repr__() → str
property entries: list[int]

List of data entries in the table.

class dissect.hypervisor.disk.asif.DataStream(asif: ASIF, reserved: bool = False)

Bases: dissect.util.stream.AlignedStream

Stream to read data from an ASIF image.

Parameters:

  • asif – The ASIF image to read from.

  • reserved – Whether to allow reading into the reserved area of the ASIF image.

asif
reserved = False
directory