3 months ago
- ASIF is a new sparse disk image format for macOS 26 Tahoe, designed for virtual machines and similar to VMDK, VHDX, or QCOW2.
- The header includes fields like signature, version, directory offsets, sector count, chunk size, and metadata block offset.
- Data is organized into directories, tables, and chunk groups with bitmaps for allocation tracking, enabling sparse storage.
- Reverse engineering involved analyzing hexdumps and the diskimagescontroller binary to understand the format's structure and access algorithms.
- Reading from ASIF requires calculating table and chunk indices based on offset, chunk size, and group mappings.
- The implementation is available in dissect.hypervisor, allowing tools to parse ASIF files and extract disk and volume information.