Finding Volume Label and Understanding the APFS Partition
0
votes
0
answers
621
views
I would like to understand the Format Partition
Using the command
Checking the https://developer.apple.com/support/downloads/Apple-File-System-Reference.pdf
Here another blogs
1. https://blog.cugu.eu/post/apfs/
2. https://www.ntfs.com/apfs-structure.htm
3. https://digital-forensics.sans.org/media/FOR518-Reference-Sheet.pdf
4. https://link.springer.com/content/pdf/10.1007/978-3-030-98467-0_1.pdf *(last addition)*
Here a resume that I made of the First structure or Format Header of
I would like the position of Label ('APFS' I named like File System) of my Volume.
Checking my First 4096 first bytes on my disk
**after
(About the picture above)**Point 2:**
APSB
Thanks a lot in advance!
APFS
on Linux
Side.
I made this question https://unix.stackexchange.com/questions/597308
I have a USB External SSD with 4 disk partitions. The file system of partitions are
- APFS
- ExFAT
- ext4
- NTFS
Now I would like to find the Label (The Volume is named 'APFS') on my APFS
partition....

diskutil list
Can you see the /dev/disk3
.

APFS
Partition.


NXSB
**
**nx_block_size
** (4 bytes) is located at position 24(16) = 36(10)
with value of 1000(16) = 4096(10)
bytes.
**nx_block_count
** (8 bytes) is located at position 28(16) = 40(10)
, here 037E0E80(16) = 58592896(10)
.
**nx_xp_desc_blocks
** (4 bytes) is located at position 68(16) = 104(10)
used with value of 0118(16) = 280(10)
blocks (the checkpoint descriptor area consists of 280 blocks).
**nx_xp_desc_len
** (4 bytes) is located at position 8C(16) = 140(10)
used with value of 02(16) = 2(10)
.
(About the picture above)**Point 4:** What does it mean that nx_efi_jumpstart_t
have 00 00 00 00 | 00 00 00 00
, where is there supposed to be an address?

nx_xp_desc_base
How must be interpreted the bytes 45 81 00 00 | 00 00 00 00
?, is it a relative memory position or absolute memory position or Jump?
Little-endian: 45 81 00 00 00 00 00 00
Big-endian: 00 00 00 00 00 00 81 45
**Decimal**: 33093
(About the picture above)**Point 6:** nx_omap_oid
How must be interpreted the bytes 46 7e 09 00 | 00 00 00 00
?, is it a relative memory position or absolute memory position or Jump?
Little-endian: 46 7E 09 00 00 00 00 00
Big-endian: 00 00 00 00 00 09 7E 46
**Decimal**: 622150
(About the picture above)**Point 7:** nx_fs_oid
How must be interpreted the bytes 02 04 00 00 | 00 00 00 00
?,
Little-endian: 02 04 00 00 00 00 00 00
Big-endian: 00 00 00 00 00 00 04 02
**Decimal**: 1026
is it a relative memory position or absolute memory position or Jump?
NXSB


Asked by joseluisbz
(815 rep)
Jul 17, 2020, 04:29 AM
Last activity: Jun 21, 2025, 06:42 AM
Last activity: Jun 21, 2025, 06:42 AM