APFS filesystem format

#1

Post by mkup » Sat, Apr 22, 2017, 7:35 PM UTC

APFS filesystem format
blog.cugu.eu

Re: APFS filesystem format

#2

Post by tradersam » Sat, Apr 22, 2017, 8:59 PM UTC

Ends a little abruptly (as in no closing) but other than that interesting read.

Re: APFS filesystem format

#3

Post by mbell » Sat, Apr 22, 2017, 9:03 PM UTC

tradersam wrote: post #2

Ends a little abruptly (as in no closing) but other than that interesting read.

It's a description of the format, not a review of it. What conclusion were you after?

Re: APFS filesystem format

#4

Post by tradersam » Sat, Apr 22, 2017, 9:04 PM UTC

mbell wrote: post #3

tradersam wrote: post #2

Ends a little abruptly (as in no closing) but other than that interesting read.

It's a description of the format, not a review of it. What conclusion were you after?

Fair point! I looked at it more of a blog post, but I suppose I should've looked at it more as a resource. My mistake.

Re: APFS filesystem format

#5

Post by tomsmeding » Sat, Apr 22, 2017, 9:04 PM UTC

Awesome research, would love to be able to do that.

Some things that came to mind: I like that some of the block types are "acronyms" of their meanings: 5 = S(pace man), B = B(-tree), C = C(heckpoint). Also, I wonder why the volume superblock magic is "APSB", while the root (container) magic is "NXSB"; maybe this refers to NextStep? Seems a bit anachronistic, but I don't know.

Re: APFS filesystem format

#6

Post by karmicthreat » Sat, Apr 22, 2017, 9:08 PM UTC

Kaitai which was used as a parser for this looks pretty interesting. I need to reverse engineer some of the Allen Bradley Ethernet Industrial Protocol and its client communication. This seems pretty useful for documenting that.

Re: APFS filesystem format

#7

Post by johnpowell » Sat, Apr 22, 2017, 9:10 PM UTC

mbell wrote: post #3

tradersam wrote: post #2

Ends a little abruptly (as in no closing) but other than that interesting read.

It's a description of the format, not a review of it. What conclusion were you after?

I wasn't even after a conclusion or anything. But since there isn't a footer I just thought maybe my internet connection died and it only loaded a portion of the page.

Re: APFS filesystem format

#8

Post by fasterthanlime » Sat, Apr 22, 2017, 9:14 PM UTC

Typo thread!

"this hight result in" => "might"

"and seams to be related" => "seems"

"sometimes spaceman" => "sometimes called spaceman" ?

Very interesting read, thanks!

Re: APFS filesystem format

#9

Post by contingencies » Sat, Apr 22, 2017, 9:25 PM UTC

karmicthreat wrote: post #6

Kaitai which was used as a parser for this looks pretty interesting. I need to reverse engineer some of the Allen Bradley Ethernet Industrial Protocol and its client communication. This seems pretty useful for documenting that.

http://kaitai.io/

Also check out https://ohmlang.github.io/ and view the maths demo in your local copy.

Re: APFS filesystem format

#10

Post by kstenerud » Sat, Apr 22, 2017, 9:28 PM UTC

tomsmeding wrote: post #5

Awesome research, would love to be able to do that. Some things that came to mind: I like that some of the block types are "acronyms" of their meanings: 5 = S(pace man), B = B(-tree), C = C(heckpoint). Also, I wonder why the volume superblock magic is "APSB", while the root (container) magic is "NXSB"; maybe this refers to NextStep? Seems a bit anachronistic, but I don't know.

Apple superblock, and next superblock (meaning "the next superblock", not nextstep).