Apple strengthens storage flexibility with new disk image formats

Apple’s release of macOS 26 Tahoe introduced a new disk image format and updated an older one, both of which are drawing attention from system testers and forensic examiners.

Apple Sparse Image Format (ASIF)

The Apple Sparse Image Format (ASIF) is a single-file sparse disk image. Although it can be assigned a large nominal capacity, it only consumes space on the host volume as data is written.

ASIF containers can be formatted with the file systems normally supported by macOS, such as APFS, HFS+, FAT, or exFAT. When encrypted, the image appears as opaque data until it is unlocked with valid credentials.

Benchmarks reported by testers show that ASIF can deliver high throughput on Apple silicon, in some cases approaching native SSD performance, although this depends on workload, encryption, and hardware.

From a compatibility standpoint, most non-macOS tools do not yet recognize the format and will present it as raw binary data, meaning that reliable analysis requires macOS or dedicated support.

Sparse Bundle Image (UDSB)

In macOS 26, the Sparse Bundle Image (UDSB) format has been refreshed, and users continue to see it offered in Disk Utility when creating disk images. Unlike the single-file ASIF, a sparse bundle is a directory containing multiple small “band” files that expand as needed, which simplifies copying and synchronization within macOS.

These images can be formatted with common macOS-supported file systems. Their banded structure, however, often confuses third-party forensic tools, and modification timestamps on the outer bundle may not correspond to activity inside the mounted volume.

Mounting sparse bundles outside macOS remains challenging and often requires Apple’s APIs.

Forensic challenges

The biggest issue for investigators is compatibility. Many forensic tools outside macOS do not yet recognize ASIF and will treat such images as raw binary data. Sparse bundles are somewhat better understood, but their banded structure still complicates examination.

Creating ASIF images currently requires macOS 26, and Apple has not documented whether they will remain backward-compatible with earlier versions.

Virtualization platforms and third-party forensic suites also differ in their support, which may complicate integration into existing laboratory workflows.is this article finaly correct now.