.DMG file signature
A Apple disk image file begins with the bytes 6B 6F 6C 79 (koly in ASCII) at 512 bytes before the end of the file. The signature is the same whatever the file is named, which is why a renamed or extensionless DMG file is still recognisable.
Signature
| Offset | Hex | ASCII |
|---|---|---|
| end -512 | 6B 6F 6C 79The koly trailer is the last 512 bytes of the file, not the start. | koly |
MIME type: application/x-apple-diskimage · usual extensions: .dmg
How to check a file's signature
Without installing anything: drop the file on our detector. It reads the bytes in your browser and shows the hex dump alongside the verdict; nothing is uploaded.
macOS and Linux (Terminal):
xxd -l 32 file.dmg
file file.dmgWindows (PowerShell):
Format-Hex -Path file.dmg -Count 32This signature is a trailer at the end of the file: tail -c 512 file.dmg | xxd | head.
If the bytes do not match
A file named .dmg whose first bytes are something else is not a DMG file. The common explanations are a wrong or deliberately misleading extension, a download that saved an HTML error page instead of the file, or a container such as ZIP wrapping the real content. The detector reports what the bytes say; the DMG guide explains what a genuine file should contain.