HomeAppleDiscovering Quantity Label and Understanding the APFS Partition

Discovering Quantity Label and Understanding the APFS Partition


I wish to perceive the Format Partition APFS on Linux Aspect.
I made this query https://unix.stackexchange.com/questions/597308

I’ve a USB Exterior SSD with 4 disk partitions. The file system of partitions are

  • APFS
  • ExFAT
  • ext4
  • NTFS

Now I wish to discover the Label (The Quantity is called ‘APFS’) on my APFS partition….

Discovering Quantity Label and Understanding the APFS Partition

Utilizing the command diskutil listing Are you able to see the /dev/disk3.
enter image description here

Checking the https://developer.apple.com/help/downloads/Apple-File-System-Reference.pdf

Right here one other blogs

  1. https://weblog.cugu.eu/put up/apfs/
  2. https://www.ntfs.com/apfs-structure.htm
  3. https://digital-forensics.sans.org/media/FOR518-Reference-Sheet.pdf
  4. https://hyperlink.springer.com/content material/pdf/10.1007/978-3-030-98467-0_1.pdf (final addition)

Right here a resume that I product of the First construction or Format Header of APFS Partition.
enter image description here

I would really like the place of Label (‘APFS’ I named like File System) of my Quantity.

Checking my First 4096 first bytes on my disk

enter image description here

after NXSB

nx_block_size (4 bytes) is positioned at place 24(16) = 36(10) with worth of 1000(16) = 4096(10) bytes.

nx_block_count (8 bytes) is positioned at place 28(16) = 40(10), right here 037E0E80(16) = 58592896(10).

nx_xp_desc_blocks (4 bytes) is positioned at place 68(16) = 104(10) used with worth of 0118(16) = 280(10) blocks (the checkpoint descriptor space consists of 280 blocks).

nx_xp_desc_len (4 bytes) is positioned at place 8C(16) = 140(10) used with worth of 02(16) = 2(10).

(Concerning the image above)Level 4: What does it imply that nx_efi_jumpstart_t have 00 00 00 00 | 00 00 00 00, the place is there presupposed to be an tackle?

enter image description here

(Concerning the image above)Level 2: nx_xp_desc_base How should be interpreted the bytes 45 81 00 00 | 00 00 00 00?, is it a relative reminiscence place or absolute reminiscence place or Leap?

Little-endian: 45 81 00 00 00 00 00 00
Massive-endian:    00 00 00 00 00 00 81 45
**Decimal**: 33093

(Concerning the image above)Level 6: nx_omap_oid How should be interpreted the bytes 46 7e 09 00 | 00 00 00 00?, is it a relative reminiscence place or absolute reminiscence place or Leap?

Little-endian: 46 7E 09 00 00 00 00 00
Massive-endian:    00 00 00 00 00 09 7E 46
**Decimal**: 622150

(Concerning the image above)Level 7: nx_fs_oid How should be interpreted the bytes 02 04 00 00 | 00 00 00 00?,

Little-endian: 02 04 00 00 00 00 00 00  
Massive-endian:    00 00 00 00 00 00 04 02
**Decimal**: 1026

is it a relative reminiscence place or absolute reminiscence place or Leap?

NXSB
enter image description here

APSB
enter image description here

Thanks rather a lot upfront!

RELATED ARTICLES

LEAVE A REPLY

Please enter your comment!
Please enter your name here

- Advertisment -
Google search engine

Most Popular

Recent Comments