Sample Header Ad - 728x90

Finding Volume Label and Understanding the APFS Partition

0 votes
0 answers
621 views
I would like to understand the Format Partition APFS on Linux Side. I made this question https://unix.stackexchange.com/questions/597308 I have a USB External SSD with 4 disk partitions. The file system of partitions are - APFS - ExFAT - ext4 - NTFS Now I would like to find the Label (The Volume is named 'APFS') on my APFS partition.... enter image description here Using the command diskutil list Can you see the /dev/disk3. enter image description here Checking the https://developer.apple.com/support/downloads/Apple-File-System-Reference.pdf Here another blogs 1. https://blog.cugu.eu/post/apfs/ 2. https://www.ntfs.com/apfs-structure.htm 3. https://digital-forensics.sans.org/media/FOR518-Reference-Sheet.pdf 4. https://link.springer.com/content/pdf/10.1007/978-3-030-98467-0_1.pdf *(last addition)* Here a resume that I made of the First structure or Format Header of APFS Partition. enter image description here I would like the position of Label ('APFS' I named like File System) of my Volume. Checking my First 4096 first bytes on my disk enter image description here **after NXSB** **nx_block_size** (4 bytes) is located at position 24(16) = 36(10) with value of 1000(16) = 4096(10) bytes. **nx_block_count** (8 bytes) is located at position 28(16) = 40(10), here 037E0E80(16) = 58592896(10). **nx_xp_desc_blocks** (4 bytes) is located at position 68(16) = 104(10) used with value of 0118(16) = 280(10) blocks (the checkpoint descriptor area consists of 280 blocks). **nx_xp_desc_len** (4 bytes) is located at position 8C(16) = 140(10) used with value of 02(16) = 2(10). (About the picture above)**Point 4:** What does it mean that nx_efi_jumpstart_t have 00 00 00 00 | 00 00 00 00, where is there supposed to be an address? enter image description here (About the picture above)**Point 2:** nx_xp_desc_base How must be interpreted the bytes 45 81 00 00 | 00 00 00 00?, is it a relative memory position or absolute memory position or Jump? Little-endian: 45 81 00 00 00 00 00 00 Big-endian: 00 00 00 00 00 00 81 45 **Decimal**: 33093 (About the picture above)**Point 6:** nx_omap_oid How must be interpreted the bytes 46 7e 09 00 | 00 00 00 00?, is it a relative memory position or absolute memory position or Jump? Little-endian: 46 7E 09 00 00 00 00 00 Big-endian: 00 00 00 00 00 09 7E 46 **Decimal**: 622150 (About the picture above)**Point 7:** nx_fs_oid How must be interpreted the bytes 02 04 00 00 | 00 00 00 00?, Little-endian: 02 04 00 00 00 00 00 00 Big-endian: 00 00 00 00 00 00 04 02 **Decimal**: 1026 is it a relative memory position or absolute memory position or Jump? NXSB enter image description here APSB enter image description here Thanks a lot in advance!
Asked by joseluisbz (815 rep)
Jul 17, 2020, 04:29 AM
Last activity: Jun 21, 2025, 06:42 AM