Does a DMG encrypt filenames?

Solution 1:

The file names within the DMG are also encrypted, so unless they break the encryption in general, the filenames are protected (i.e. as protected as the file contents).

A DMG file is essentially just a raw disk image, similar to what you would get if you read out a normal block device (such as a hard drive or SSD) to a character file.

An encrypted DMG file is just the encrypted version of that raw disk image with an extra header at the beginning of the file. Note: On very old Mac OS X versions (10.5 and earlier) a slightly different layout were used where the header is at the end of file.

The header contains, amongst other things, the so called "salt" for key derivation. In simple terms, the salt is combined with the password you enter to decrypt, and run through a key derivation function (PBKDF2) to produce the actual encryption key. The use of this key derivation function makes it harder to brute-force the password, as key derivation is relatively costly in terms of CPU usage.