search

cugu / afro

File recovery for APFS
159 stars 15 forks source link

Object type flags fix #14

Closed shoaloak closed 4 years ago

shoaloak commented 4 years ago

We added a link to the paper where AFRO is presented.

Also, we fixed the object_type_flags enum since it was defined as a 32-bit field while both the upper and lower half are defined as 16-bits within AFRO/APFS. The APFS field values from the specification are kind of misleading regarding this matter.

cugu commented 4 years ago

LGTM. Thanks!

shoaloak commented 4 years ago

Hi @cugu, @woudtje and I have extended AFRO to also detect Hidden Data based on previous research. Would you be willing to incorporate this into AFRO? We were thinking of dubbing it AFRO-HD (Hidden Detection).

cugu commented 4 years ago

@shoaloak Sure, seems to be a nice feature.

shoaloak commented 4 years ago

Cool, we will do a pull request once our research is concluded.

Also, would you perhaps be willing to discuss some of our results? Get in touch @ Axel.Koolhaas[at]os3.nl