This project is not maintained any more.

Feel free to fork it. If you have an active fork and you want to be linked here you can contact me.

apfs.ksy

APFS filesystem format for Kaitai Struct (http://kaitai.io/)

Usage

Use the Kaitai WebIDE to examine APFS filesystems and to continue reverse engineering APFS: https://ide.kaitai.io/devel/ (the development version currently supports some nice additional features). A brief explanation of how the Web IDE works: https://github.com/kaitai-io/kaitai_struct_webide/wiki/Features

Documentation

Information about the checksum calculation can be found in checksum.md.

More documentation on APFS

• Apple File System Reference: Official, but incomplete APFS spec
• Decoding the APFS file system: Paper by Kurt H.Hansen and Fergus Toolan Fergus in Digital Investigation. Published: 2017-09-22.
• Apple File System Guide: Official documentation on APFS. Lacks lots of information on APFS. Last update: 2017-09-21.
• APFS filesystem format: Deprecated blog post by myself. Still contains some useful diagrams. Last update: 2017-04-30.

Tools with APFS support

• iBored by Thomas Tempelmann: Free hex editor with support for APFS volumes starting in version 1.2 (Note that these beta versions may contain support only for APFS, whereas the official (older) release supports many other formats like FAT, HFS etc.. While it does currently not read this ksy file for its templates feature, its templates.xml file is modeled (manually) after this ksy file.
• Find Any File by Thomas Tempelmann: Fast search for filenames on a disk.
• 010 Editor + APFS template by Yogesh Khatri: hex editor with support for APFS volumes - use this template https://github.com/ydkhatri/APFS_010

Contributing

Pull requests and issues are welcome!