0

I would like to understand the Format Partition APFS on Linux Side. I made this question https://unix.stackexchange.com/questions/597308

I have a USB External SSD with 4 disk partitions. The file system of partitions are

  • APFS
  • ExFAT
  • ext4
  • NTFS

Now I would like to find the Label (The Volume is named 'APFS') on my APFS partition....

enter image description here

Using the command diskutil list Can you see the /dev/disk3. enter image description here

Checking the https://developer.apple.com/support/downloads/Apple-File-System-Reference.pdf

Here another blogs

  1. https://blog.cugu.eu/post/apfs/
  2. https://www.ntfs.com/apfs-structure.htm
  3. https://digital-forensics.sans.org/media/FOR518-Reference-Sheet.pdf
  4. https://link.springer.com/content/pdf/10.1007/978-3-030-98467-0_1.pdf (last addition)

Here a resume that I made of the First structure or Format Header of APFS Partition. enter image description here

I would like the position of Label ('APFS' I named like File System) of my Volume.

Checking my First 4096 first bytes on my disk

enter image description here

At position 24(16) = 36(10) (after NXSB) is located nx_block_size (4 bytes) used with value of 1000(16) = 4096(10) bytes. At position 28(16) = 40(10) is located nx_block_count (8 bytes), here 37E0E80(16) = 58592896(10).

At position 68(16) = 104(10) is located nx_xp_desc_blocks (4 bytes) used with value of 118(16) = 280(10) blocks (the checkpoint descriptor area consists of 280 blocks).

At position 8C(16) = 140(10) is located nx_xp_desc_len (4 bytes) used with value of 2(16) = 2(10).

(About the picture above)Point 4: What does it mean that nx_efi_jumpstart_t have 00 00 00 00 | 00 00 00 00, where is there supposed to be an address?

enter image description here

(About the picture above)Point 2: nx_xp_desc_base How must be interpreted the bytes 45 81 00 00 | 00 00 00 00?, is it a relative memory position or absolute memory position or Jump?

(About the picture above)Point 6: nx_omap_oid How must be interpreted the bytes 46 7e 09 00 | 00 00 00 00?, is it a relative memory position or absolute memory position or Jump?

(About the picture above)Point 7: nx_fs_oid How must be interpreted the bytes 02 04 00 00 | 00 00 00 00?, is it a relative memory position or absolute memory position or Jump?

Thanks a lot in advance!

joseluisbz
  • 786
  • Swiggity Swooty, that's some disk you've got their! Crazy thing, all that info you added and the ONE thing needed is diskutil apfs list :) – Jahhein Jul 17 '20 at 04:35
  • I made first checking on CentOS 8 may be making this Check on macOS have advantage over Linux where is the real target. I need to mount the AFPS with its label on Linux. – joseluisbz Jul 17 '20 at 05:02
  • Perhaps I'm a bit tired, but isn't a label on a partition just a label that actually doesn't do anything? the UUID is what you should be after for each partition. Perhaps your partition map might be wrong for your task? Master boot record is what linux and windows prefer to read from... and apfs is still pretty new. – Jahhein Jul 17 '20 at 05:18
  • I'm reading manually with Hexdump directly on disk/partition. It doesn't matter if it's not mounted as APFS, I can still read it. I need to track manually because I want to implement a code in order to find the label on Linux Side. – joseluisbz Jul 17 '20 at 05:28
  • https://apple.stackexchange.com/q/338063/194804 – joseluisbz Aug 13 '22 at 05:08

0 Answers0