±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36107
New Yesterday: 1 Visitors: 136

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

New File System on Macs

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3, 4, 5  Next 
  

randomaccess
Senior Member
 

Re: New File System on Macs

Post Posted: Oct 17, 17 11:30

I also had a play around a few weeks ago with APFS and a few tools at the time. I documented my findings here  
 
  

benfindlay
Senior Member
 

Re: New File System on Macs

Post Posted: Dec 15, 17 09:21

Just to update (and for those not already aware), X-Ways have apparently added support for APFS as of 19.4 SR-2.

See http://www.x-ways.net/winhex/forum/messages/1/4931.html?1511344633 for details

NB: I've not tested this myself. Do any of the other main tools offer support yet?

Cheers,

Ben
_________________
Ben Findlay. BSc (Hons) MSc PgCLTHE FHEA MBCS MCSFS MIScT MInstISP
Course Leader BSc Computer and Digital Forensics
School of Science, Engineering and Design
Teesside University 
 
  

randomaccess
Senior Member
 

Re: New File System on Macs

Post Posted: Dec 15, 17 10:42

- benfindlay
Just to update (and for those not already aware), X-Ways have apparently added support for APFS as of 19.4 SR-2.


hey ben, they added "support".
ie it says that it's an APFS volume but doesn't parse the file system.
That being said, I tested it on a volume that was file vaulted, i haven't seen how it goes with a disk image created with disk utility. If you've got xways handy you can pull down a disk image i created over on thinkdfir.com  
 
  

benfindlay
Senior Member
 

Re: New File System on Macs

Post Posted: Dec 15, 17 15:02

- randomaccess
- benfindlay
Just to update (and for those not already aware), X-Ways have apparently added support for APFS as of 19.4 SR-2.


hey ben, they added "support".
ie it says that it's an APFS volume but doesn't parse the file system.
That being said, I tested it on a volume that was file vaulted, i haven't seen how it goes with a disk image created with disk utility. If you've got xways handy you can pull down a disk image i created over on thinkdfir.com


Now that's an "interesting" distinction! Razz

Thanks for the link - I've added those images into XWF and found that you are quite right - recognition of the APFS filesystem but no actual files and folders.

I also partitoned and formatted a USB stick with GPT/APFS using a Mac running High Sierra to test this on a phsyical drive, rather than via DMG files/virtual drives (my understanding is that the DMG format uses the old Apple Partition Table system so I wanted to eliminate that from the equation). The same results were observed - screenshot here.

It's a step forward at least, but I wonder when full compatibility will reach us?
_________________
Ben Findlay. BSc (Hons) MSc PgCLTHE FHEA MBCS MCSFS MIScT MInstISP
Course Leader BSc Computer and Digital Forensics
School of Science, Engineering and Design
Teesside University 
 
  

randomaccess
Senior Member
 

Re: New File System on Macs

Post Posted: Dec 16, 17 00:45

when apple open sources the file system
or someone reverse engineers it

i'd say that people are working on the second, i doubt the first will come to pass  
 
  

jaclaz
Senior Member
 

Re: New File System on Macs

Post Posted: Dec 16, 17 19:00

- randomaccess

or someone reverse engineers it


It seems like following this post:
blog.cugu.eu/post/apfs/

some work has been done:
github.com/cugu/apfs
github.com/tienex/apfs


(no idea on the amount of progresses)

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

randomaccess
Senior Member
 

Re: New File System on Macs

Post Posted: Dec 18, 17 10:50

yeah, part of that was turned into the tool mentioned by the developer in the comments of my thinkdfir post  
 

Page 3 of 5
Page Previous  1, 2, 3, 4, 5  Next