pjrinaldi / wombatforensics

linux c++, fox-toolkit, multi-threaded forensic gui tool
GNU General Public License v2.0
46 stars 12 forks source link

BCACHEFS Detection and Parsing #402

Open pjrinaldi opened 2 years ago

pjrinaldi commented 2 years ago

Need to implement detection and parsing of bcachefs. It isn't a production ready file system, but it shows real promise and would be neat to parse it on the front end and possbily before other forensic tools.

define BCACHE_MAGIC UUID_LE(0xf67385c6, 0x1a4e, 0xca45, 0x82, 0x65, 0xf5, 0x7f, 0x48, 0xba, 0x6d, 0x81)

define BCACHEFS_STATFS_MAGIC 0xca451a4e

need to get a sample bcachefs raw image to analyze.