Reverse-engineering Apple's Sparse Image Format (ASIF)

Category: Apple
Status: discussion
Sources: author write-up, discussion
Summary: Erik Schamper published a 2026-06-18 teardown of ASIF, the sparse virtual-disk format Apple introduced in macOS 26 Tahoe for virtual machines. The format opens with a shdw magic signature and metadata (sector count, 1 MiB chunk size, directory offsets), organizes data through directory tables and chunk groups with embedded bitmaps using two-bit per-block allocation flags, and reaches just under 4 PiB maximum virtual size via 55-bit chunk addressing in 64-bit entries. The author recovered the layout from hex dumps and the diskimagescontroller binary in IDA Pro and released a reader in the open-source dissect.hypervisor project.
Why it matters: A documented on-disk layout and open-source reader let forensic and VM tooling inspect ASIF images without Apple's frameworks, relevant to anyone running or analyzing macOS virtual machines.