Apple Disk Image file signature
Magic number in the last 512 bytes of the file · koly
A modern Apple .dmg (UDIF) has no header magic. Its signature is a trailer: the ASCII word koly begins a 512-byte block at the very end of the file, describing the disk image.
What this magic number means
A magic number is a short, fixed run of bytes at a known position that tells a program what a file really is, no matter what the filename says. If a file ends with, 512 bytes from its end, the bytes 6B 6F 6C 79 (the text koly), it is an Apple Disk Image file.
Because the marker is at the end, not the start, tools must seek to the last 512 bytes to confirm a DMG. Older compressed DMGs may instead begin with an encrypted or zlib header.
What each byte of 6B 6F 6C 79 means
Here is the signature byte by byte, the way a hex editor shows it: the position in the file, the value in hex and in decimal, and the character that value stands for in ASCII. Bytes with no printable character show a dot.
| Byte offset | Hex | Decimal | ASCII |
|---|---|---|---|
| -512 | 6B | 107 | k |
| -511 | 6F | 111 | o |
| -510 | 6C | 108 | l |
| -509 | 79 | 121 | y |
End-of-file signature
This format is identified by its trailer, not by a header. The bytes 6B 6F 6C 79 sit near the end of the file (koly trailer, 512 bytes from the end), and there is no fixed magic number at byte 0, so a check on the first bytes finds nothing at all.
Formats that use the 6B 6F 6C 79 signature
These file types in our database carry this signature:
How to check a file's signature
You can read the bytes of any file yourself. They are shown in hex, the same way this page lists them, reading from the end of the file rather than the start.
Linux & macOS
- tail -c 512 example.dmg | xxd | head -2
- xxd -s -512 -l 4 example.dmg
- file example.dmg
Windows (PowerShell)
- Get-Content example.dmg -AsByteStream -Tail 512 | Format-Hex
Python
- f=open("example.dmg","rb");f.seek(-512,2);f.read(4).hex()
In your browser
- Drop the file into the WhatFileType identifier, which reads the signature without uploading it.
Frequently asked questions
What is the Apple Disk Image file signature?
Apple Disk Image files end with, 512 bytes from the end, the hex bytes 6B 6F 6C 79 (koly in ASCII). This magic number identifies the format regardless of the file's name or extension.
How do I check a file's magic number?
Read the end of the file rather than the start: tail -c 512 example.dmg | xxd | head -2 on Linux or macOS, or in Python f=open("example.dmg","rb"); f.seek(-512, 2); f.read(4).hex().
Can a file fake the Apple Disk Image signature?
Renaming a file does not change its bytes, so the extension can lie but the signature usually cannot. A genuine Apple Disk Image file has these exact bytes; a file with the wrong bytes is not really Apple Disk Image, whatever its name says.
Related signatures
Sources
Reuse this signature
This entry is part of the WhatFileType file signature reference, published under a CC BY 4.0 licence with the full provenance for every entry, a copy-paste embed and a JSON export. Credit WhatFileType and the data is yours to republish.