I wish to perceive the Format Partition APFS
on Linux
Aspect.
I made this query https://unix.stackexchange.com/questions/597308
I’ve a USB Exterior SSD with 4 disk partitions. The file system of partitions are
APFS
ExFAT
ext4
NTFS
Now I wish to discover the Label (The Quantity is called ‘APFS’) on my APFS
partition….
Utilizing the command diskutil listing
Are you able to see the /dev/disk3
.
Checking the https://developer.apple.com/help/downloads/Apple-File-System-Reference.pdf
Right here one other blogs
- https://weblog.cugu.eu/put up/apfs/
- https://www.ntfs.com/apfs-structure.htm
- https://digital-forensics.sans.org/media/FOR518-Reference-Sheet.pdf
- https://hyperlink.springer.com/content material/pdf/10.1007/978-3-030-98467-0_1.pdf (final addition)
Right here a resume that I product of the First construction or Format Header of APFS
Partition.
I would really like the place of Label (‘APFS’ I named like File System) of my Quantity.
Checking my First 4096 first bytes on my disk
after NXSB
nx_block_size
(4 bytes) is positioned at place 24(16) = 36(10)
with worth of 1000(16) = 4096(10)
bytes.
nx_block_count
(8 bytes) is positioned at place 28(16) = 40(10)
, right here 037E0E80(16) = 58592896(10)
.
nx_xp_desc_blocks
(4 bytes) is positioned at place 68(16) = 104(10)
used with worth of 0118(16) = 280(10)
blocks (the checkpoint descriptor space consists of 280 blocks).
nx_xp_desc_len
(4 bytes) is positioned at place 8C(16) = 140(10)
used with worth of 02(16) = 2(10)
.
(Concerning the image above)Level 4: What does it imply that nx_efi_jumpstart_t
have 00 00 00 00 | 00 00 00 00
, the place is there presupposed to be an tackle?
(Concerning the image above)Level 2: nx_xp_desc_base
How should be interpreted the bytes 45 81 00 00 | 00 00 00 00
?, is it a relative reminiscence place or absolute reminiscence place or Leap?
Little-endian: 45 81 00 00 00 00 00 00
Massive-endian: 00 00 00 00 00 00 81 45
**Decimal**: 33093
(Concerning the image above)Level 6: nx_omap_oid
How should be interpreted the bytes 46 7e 09 00 | 00 00 00 00
?, is it a relative reminiscence place or absolute reminiscence place or Leap?
Little-endian: 46 7E 09 00 00 00 00 00
Massive-endian: 00 00 00 00 00 09 7E 46
**Decimal**: 622150
(Concerning the image above)Level 7: nx_fs_oid
How should be interpreted the bytes 02 04 00 00 | 00 00 00 00
?,
Little-endian: 02 04 00 00 00 00 00 00
Massive-endian: 00 00 00 00 00 00 04 02
**Decimal**: 1026
is it a relative reminiscence place or absolute reminiscence place or Leap?
Thanks rather a lot upfront!