I wish to perceive the Format Partition APFS on Linux Aspect.
I made this query https://unix.stackexchange.com/questions/597308
I’ve a USB Exterior SSD with 4 disk partitions. The file system of partitions are
APFSExFAText4NTFS
Now I wish to discover the Label (The Quantity is called ‘APFS’) on my APFS partition….
Utilizing the command diskutil listing Are you able to see the /dev/disk3.

Checking the https://developer.apple.com/help/downloads/Apple-File-System-Reference.pdf
Right here one other blogs
- https://weblog.cugu.eu/put up/apfs/
- https://www.ntfs.com/apfs-structure.htm
- https://digital-forensics.sans.org/media/FOR518-Reference-Sheet.pdf
- https://hyperlink.springer.com/content material/pdf/10.1007/978-3-030-98467-0_1.pdf (final addition)
Right here a resume that I product of the First construction or Format Header of APFS Partition.

I would really like the place of Label (‘APFS’ I named like File System) of my Quantity.
Checking my First 4096 first bytes on my disk
after NXSB
nx_block_size (4 bytes) is positioned at place 24(16) = 36(10) with worth of 1000(16) = 4096(10) bytes.
nx_block_count (8 bytes) is positioned at place 28(16) = 40(10), right here 037E0E80(16) = 58592896(10).
nx_xp_desc_blocks (4 bytes) is positioned at place 68(16) = 104(10) used with worth of 0118(16) = 280(10) blocks (the checkpoint descriptor space consists of 280 blocks).
nx_xp_desc_len (4 bytes) is positioned at place 8C(16) = 140(10) used with worth of 02(16) = 2(10).
(Concerning the image above)Level 4: What does it imply that nx_efi_jumpstart_t have 00 00 00 00 | 00 00 00 00, the place is there presupposed to be an tackle?
(Concerning the image above)Level 2: nx_xp_desc_base How should be interpreted the bytes 45 81 00 00 | 00 00 00 00?, is it a relative reminiscence place or absolute reminiscence place or Leap?
Little-endian: 45 81 00 00 00 00 00 00
Massive-endian: 00 00 00 00 00 00 81 45
**Decimal**: 33093
(Concerning the image above)Level 6: nx_omap_oid How should be interpreted the bytes 46 7e 09 00 | 00 00 00 00?, is it a relative reminiscence place or absolute reminiscence place or Leap?
Little-endian: 46 7E 09 00 00 00 00 00
Massive-endian: 00 00 00 00 00 09 7E 46
**Decimal**: 622150
(Concerning the image above)Level 7: nx_fs_oid How should be interpreted the bytes 02 04 00 00 | 00 00 00 00?,
Little-endian: 02 04 00 00 00 00 00 00
Massive-endian: 00 00 00 00 00 00 04 02
**Decimal**: 1026
is it a relative reminiscence place or absolute reminiscence place or Leap?
Thanks rather a lot upfront!






