search

puffyCid / artemis

A cross platform forensic parser written in Rust!
MIT License
59 stars 6 forks source link

New FsEvents format? #125

Closed puffyCid closed 3 months ago

puffyCid commented 4 months ago

What new feature do you think would be cool to add to artemis? It looks like Apple may have updated the FsEvents file format recently(ish). Probably in Sonoma There is a new signature 3SLD and it looks like the format change a little bit

Describe the solution you'd like Update the FsEvents parser to support the new format

Additional context Looks like https://github.com/lespea/fse_dump supports the updated format

puffyCid commented 4 months ago

Based on comment looks like there is an extra 4 bytes after the Node ID? https://github.com/lespea/fse_dump/blob/dfb5a40cb15438623c2aa13d08edcd44a6e652c1/src/version.rs#L113