±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34071
New Yesterday: 1 Visitors: 127

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

New File System on Macs

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3, 4, 5  Next 
  

Re: New File System on Macs

Post Posted: Tue Oct 17, 2017 5:30 am

I also had a play around a few weeks ago with APFS and a few tools at the time. I documented my findings here  

randomaccess
Senior Member
 
 
  

Re: New File System on Macs

Post Posted: Fri Dec 15, 2017 3:21 am

Just to update (and for those not already aware), X-Ways have apparently added support for APFS as of 19.4 SR-2.

See http://www.x-ways.net/winhex/forum/messages/1/4931.html?1511344633 for details

NB: I've not tested this myself. Do any of the other main tools offer support yet?

Cheers,

Ben
_________________
Ben Findlay. BSc (Hons) MSc MBCS MCSFS MIScT
Course Leader BSc Computer and Digital Forensics
Senior Lecturer MSc Crime Intelligence & Data Analytics
School of Science, Engineering and Design
Teesside University 

benfindlay
Senior Member
 
 
  

Re: New File System on Macs

Post Posted: Fri Dec 15, 2017 4:42 am

- benfindlay
Just to update (and for those not already aware), X-Ways have apparently added support for APFS as of 19.4 SR-2.


hey ben, they added "support".
ie it says that it's an APFS volume but doesn't parse the file system.
That being said, I tested it on a volume that was file vaulted, i haven't seen how it goes with a disk image created with disk utility. If you've got xways handy you can pull down a disk image i created over on thinkdfir.com  

randomaccess
Senior Member
 
 
  

Re: New File System on Macs

Post Posted: Fri Dec 15, 2017 9:02 am

- randomaccess
- benfindlay
Just to update (and for those not already aware), X-Ways have apparently added support for APFS as of 19.4 SR-2.


hey ben, they added "support".
ie it says that it's an APFS volume but doesn't parse the file system.
That being said, I tested it on a volume that was file vaulted, i haven't seen how it goes with a disk image created with disk utility. If you've got xways handy you can pull down a disk image i created over on thinkdfir.com


Now that's an "interesting" distinction! Razz

Thanks for the link - I've added those images into XWF and found that you are quite right - recognition of the APFS filesystem but no actual files and folders.

I also partitoned and formatted a USB stick with GPT/APFS using a Mac running High Sierra to test this on a phsyical drive, rather than via DMG files/virtual drives (my understanding is that the DMG format uses the old Apple Partition Table system so I wanted to eliminate that from the equation). The same results were observed - screenshot here.

It's a step forward at least, but I wonder when full compatibility will reach us?
_________________
Ben Findlay. BSc (Hons) MSc MBCS MCSFS MIScT
Course Leader BSc Computer and Digital Forensics
Senior Lecturer MSc Crime Intelligence & Data Analytics
School of Science, Engineering and Design
Teesside University 

benfindlay
Senior Member
 
 
  

Re: New File System on Macs

Post Posted: Fri Dec 15, 2017 6:45 pm

when apple open sources the file system
or someone reverse engineers it

i'd say that people are working on the second, i doubt the first will come to pass  

randomaccess
Senior Member
 
 
  

Re: New File System on Macs

Post Posted: Sat Dec 16, 2017 1:00 pm

- randomaccess

or someone reverse engineers it


It seems like following this post:
blog.cugu.eu/post/apfs/

some work has been done:
github.com/cugu/apfs
github.com/tienex/apfs


(no idea on the amount of progresses)

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: New File System on Macs

Post Posted: Mon Dec 18, 2017 4:50 am

yeah, part of that was turned into the tool mentioned by the developer in the comments of my thinkdfir post  

randomaccess
Senior Member
 
 

Page 3 of 5
Go to page Previous  1, 2, 3, 4, 5  Next