search

sgan81 / apfs-fuse

FUSE driver for APFS (Apple File System)
GNU General Public License v2.0
1.74k stars 164 forks source link

Implement Catalina's Firmlinks #112

Open ydkhatri opened 4 years ago

ydkhatri commented 4 years ago

In macOS 10.15 (Catalina), the presented root volume is a combination of two volumes on disk - a System and a Data volume. These volumes can be identified by their Volume Role flags ( APFS_VOL_ROLE_SYSTEM and APFS_VOL_ROLE_DATA). It would be nice to have this functionality implemented in apfs-fuse itself, so any tool that can run on a live mac volume can also work on a mounted image then (and be able to find all files). Volumes are stitched together using a firmlinks file, the scheme is really simple, much like sym links. Firmlink info are stored in this file - /usr/share/firmlinks The inode numbers are unique between the volumes, so it should be easy to implement. Link to more info about this: https://www.swiftforensics.com/2019/10/macos-1015-volumes-firmlink-magic.html

RJVB commented 4 years ago

It would be nice to have this functionality implemented in apfs-fuse itself

Probably, but ... what a mess! If I understand the linked documentation correctly this even violates the principle that a single /dev/diskN identifies a single physical device..

ydkhatri commented 4 years ago

It would be nice to have this functionality implemented in apfs-fuse itself Probably, but ... what a mess! If I understand the linked documentation correctly this even violates the principle that a single /dev/diskN identifies a single physical device..

Unfortunately, we aren't the innovators here, just playing catch-up to whatever Apple dishes out.

Ideally, this new functionality can be added with a new option switch (so the default behavior of the program does not change).

sgan81 commented 4 years ago

Yes, quite a mess, but I might have a look into it at some time. I also noted that firmlink inodes have some undocumented flag set.