TLDR Tech / InfoSec
Dissecting Apple's Sparse Image Format (ASIF)
ASIF is a sparse virtual disk format for macOS Tahoe geared toward virtual machines and similar to VMDK, VHDX, and QCOW2 in concept but with its own layout and header structure. The researcher walks through building a parser by generating a test ASIF image, inspecting hexdumps, and reverse engineering DiskImages2's diskimagescontroller binary to recover header fields, directory offsets, and chunk metadata. ASIF uses directory tables of 64‑bit entries, grouping chunk pointers with embedded allocation bitmaps so each table directly mixes mapping and bitmap data, which affects how offsets map to chunks. Finally refines the math for translating a virtual disk offset into table index, chunk index, and flags, then points to a working implementation in dissect.hypervisor for practical parsing and forensic use.
Read the full story