APFS File System Format Reference Sheet Volume Super Block (apfs_superblock_t) B-Tree Node (btree_node_phys_t)

By: Sarah Edwards| Twitter: @iamevltwin | Email: [email protected]

Offset Size Field Notes Offset Size Field Notes
FOR518 - Mac and iOS Forensic Analysis & Incident Response - for518.com (in (in bytes)
bytes)
32 2 btn_flags Flags (Leaf Node)
Object Header (obj_phys_t) 32 4 apfs_magic “APSB” Volume Magic Number 0x41505342 = “APSB” 34 2 btn_level Number of Child Levels below this Node
36 4 apfs_fs_index Index in Volume Array 36 4 btn_nkeys Number of Keys
40 8 apfs_features Features 40 2 btn_table_space.off Offset to Table of Contents (after btree_node_phys_t)
Offset Size Field Notes 48 8 apfs_readonly_compatible_features Read-only Incompatible Features 42 2 btn_table_space.len Length of Table of Contents
(in bytes) 56 8 apfs_incompatible_features Incompatible Features
44 2 btn_freespace.off Offset Key/Value Free Space
0 8 o_cksum Fletcher 64 Checksum 64 8 apfs_unmount_time Timestamp when volume was last unmounted
46 2 btn_freespace.len Length of Key/Value Free Space
8 8 o_oid Object ID 72 8 apfs_fs_reserve_block_count Block Pre-allocated for Volume (Default is none)
48 2 btn_key_free_list.off Offset to Free Key Space
16 8 o_xid Transaction ID 80 8 apfs_fs_quota_block_count Maximum Block Allocated (Default is none)
50 2 btn_key_free_list.len Length of Free Key Space
24 2 o_type.type Object Type 88 8 apfs_fs_alloc_count Number of blocks currently allocated
52 2 btn_val_free_list.off Offset to Free Value Space
26 2 o_type.flags Object Flags 96 2 wrapped_crypto_state_t. Key Encryption Metadata – Major Version
54 2 btn_val_free_list.len Length of Free Value Space
wrapped_crypto_state.major_version
28 4 o_subtype Object Subtype
98 2 wrapped_crypto_state_t. Key Encryption Metadata – Minor Version B-Tree Node – Table of Contents B-Tree Node – File System Key
Object Type Object Type Object Type/Subtype wrapped_crypto_state.minor_version
(Hex) (Dec) 100 4 wrapped_crypto_state_t. Key Encryption Metadata – Encryption State Flags
Offset Size Field Notes Offset Size Field
0x0000 0 None wrapped_crypto_state.cpflags (in bytes) (in bytes)
0x0100 1 Container Super Block 104 4 wrapped_crypto_state_t. Key Encryption Metadata – Protection Class
0x0200 2 B-Tree TOC Entry + 2 2 key_offset Key Offset 0 7 Object ID – Inode Number
wrapped_crypto_state.persistent_class
0x0300 3 B-Tree Node TOC Entry + 4 2 key_length Key Length 7 1 Entry Kind
108 4 wrapped_crypto_state_t. Key Encryption Metadata – Creator OS Version
0x0500 5 Spaceman TOC Entry + 6 2 value _offset Value Offset 0x30 – Inode
0x0B00 11 Object Map (OMAP) wrapped_crypto_state.key_os_version 0x39004313 = 19 C 57 – 19C57 – Catalina 10.15.2 TOC Entry + 8 2 value_length Value Length 0x60 – Data Stream
112 2 wrapped_crypto_state_t. Key Encryption Metadata – Key Version
0x0D00 13 File System (Volume Super 0x40 – Xattr (2 byte Name
Block) wrapped_crypto_state.key_revision
Length + Variable Xattr Name)
0x0E00 14 File System Tree 114 2 wrapped_crypto_state_t. Key Encryption Metadata – Key Size (0 for no Encryption)
Value - Inode File Metadata 0x60 – File Extent (8 byte
wrapped_crypto_state.key_len
Logical Address
Container Super Block (nx_superblock_t) N/A 0 wrapped_crypto_state_t. Key Encryption Metadata – Wrapped Key
wrapped_crypto_state.persistent_key No Key field is null, see key_len above
Offset Size Field Notes
116 4 apfs_root_tree_oid_type Type of Root File System Tree = B-Tree (in bytes)
Offset Size Field Notes
120 4 apfs_extentref_tree_oid_type Type of Extent Reference Tree = B-Tree, Physical
(in bytes) 0 8 parent_id Parent Inode Number
124 4 apfs_snap_meta_tree_oid_type Type of Snapshot Metadata Tree = B-Tree, Physical
32 4 magic “NXSB" Container Magic Number: 0x4E585342 = 128 8 apfs_omap_oid Physical Object ID (OID) of Object Map 8 8 private_id Inode Number
“NXSB” 136 8 apfs_root_tree_oid Virtual Object ID (OID) of Root File System Tree 16 8 create_time Create Timestamp
36 4 nx_block_size Block Size (ie: 4096) 144 8 apfs_extentref_tree_oid Physical Object ID (OID) of Extent Reference Tree 24 8 mod_time Modification Timestamp
40 8 nx_block_count Block Count (Block Count*Block Size = 152 8 apfs_snap_meta_tree_oid Virtual Object ID (OID) of Snapshot Metadata Tree 32 8 change_time Change Timestamp
160 8 apfs_revert_to_xid Transaction ID (XID) that volume will revert to 40 8 access_time Access Timestamp
Container Size in Bytes
48 8 nx_features Features 168 8 apfs_revert_to_sblock_oid Virtual Object ID (OID) of Volume Superblock to revert to 48 8 internal_flags Internal Flags
56 8 nx_read_only_ compatible_features Read-only Compatible Features 176 8 apfs_next_obj_id Next Object ID (OID) 56 4 nchildren or nlink Children or Links
64 8 nx_incompatable_features Incompatible Features 184 8 apfs_num_files Number of Regular Files 60 4 default_protection_class Default Protection Class
72 16 nx_uuid Container UUID (diskutil info /dev/disk#) 192 8 apfs_num_directories Number of Directories 64 4 write_generation_counter Write Generation Counter
200 8 apfs_num_symlinks Number of Symbolic Links 68 4 bsd_flags BSD Flags
88 8 nx_next_oid Next Object ID (OID) 72 4 owner Owner
208 8 apfs_num_other_fsobjects Number of Other Files
96 8 nx_next_xid Next Transaction ID (XID) 76 4 group Group
216 8 apfs_num_snapshots Number of Snapshots
104 4 nx_xp_desc_blocks Blocks used by Checkpoint Descriptor Area 80 2 mode File Mode
224 8 apfs_total_blocks_alloced Blocks Allocated by Volume
232 8 apfs_total_blocks_freed Blocked Freed by Volume 82 2 pad1 Pad1
108 4 nx_xp_data_blocks Blocks used by Checkpoint Data Area
240 16 apfs_vol_uuid Volume UUID (diskutil info /dev/disk#s# [Volume]) 84 8 pad2 Pad2
112 8 nx_xp_desc_base Base address of Checkpoint Descriptor
256 8 apfs_last_mod_time Last Modified Timestamp 92 2 xf_num_exts Number of Extended Fields
Area or Physical Object ID
264 8 apfs_fs_flags Flags 94 2 xf_used_data Extended Fields Data Used
120 8 nx_xp_data_base Base address of Checkpoint Data Area or
272 32 apfs_modified_by_t.formatted_by.id[] Format Program and Version 96 x_field_t[]
Physical Object ID Extended Field:
= 4 bytes x_type (1 byte), x_flags (1 byte), x_size (2 bytes)
128 4 nx_xp_desc_next Next Index for Checkpoint Descriptor Area 304 8 apfs_modified_by_t.formatted_by. Format Timestamp
Each
132 4 nx_xp_data_next Next Index for Checkpoint Data Area timestamp 96 4
312 8 apfs_modified_by_t.formatted_by. Format Transaction ID (XID) EXAMPLE EXTENDED FIELD: 0x04 = 4, 0x02 (Do Not Copy), 0x1100 = 17 (File Name)
136 4 nx_xp_desc_index Index for first item in Checkpoint
last_xid 100 4
Descriptor Area EXAMPLE EXTENDED FIELD: 0x08 = 8, 0x20 (System Field), 0x2800 = 40 (Data Stream)
140 4 nx_xp_desc _len Number of blocks in Checkpoint Descriptor 320 32 apfs_modified_by_t.modified_by.id[] Last Modified Program and Version
352 8 apfs_modified_by_t.modified_by. Last Modified Timestamp 104 {17} File Name smudge_yoda.jpeg (w/1 padding bytes 0x00), 17 total
Area Used
timestamp bytes
144 4 nx_xp_data_index Index for first item in Checkpoint Data Area
360 8 apfs_modified_by_t.modified_by. last_xid Last Modified Transaction ID (XID) 120 {40} Data Stream 0x00000000000000 – 7 unused bytes
148 4 nx_xp_data _len Number of blocks in Checkpoint Data Area (Size: First 8 bytes, Allocated: Next 8 Size: 0x261C020000000000 = 138278 bytes
368 336 apfs_modified_by_t.modified_by[1-7] Array of apfs_modified_by_t[8]
Used bytes) Allocated: 0x0020020000000000 = 139264
152 8 nx_spaceman_oid Space Manager Object ID (OID) 704 256 apfs_volname APFS Volume Name
160 8 nx_omap_oid Container Object Map Object ID (OID) 960 4 apfs_next_doc_id Next Document ID Value – Inode File Extent APFS Format References:
168 8 nx_reaper_oid Reaper Object ID (OID) 964 2 apfs_role APFS Role (None, System, Data, Preboot, VM, Recovery) • Apple File System Reference (Apple Developer Documentation)
176 4 nx_test_type Reserved for Testing 966 2 apfs_reserved Reserved • 2019-02-07
Offset Size Field
180 4 nx_max_file_systems Maximum Number of Volumes in this 976 8 apfs_root_to_xid Transaction ID (XID) of Snapshot to Root
(in bytes) APFS is Little Endian & 64-bit
Container 984 8 apfs_er_state_oid Current State of Encryption/Decryption
184 8 nx_fs_oid[0] Array of OIDs for Volumes in this Container 0 8 File Size
8 8 Physical Block Location
Updated: 012020 16 8 Crypto ID
 Live Response Image Mount & Eject
SANS FOR518 Reference Sheet date Local System Time (-u for UTC) APFS with xmount $ sudo mkdir /Volumes/galaga_image/
hostname System Hostname (xmount v.0.7.*) $ sudo mkdir /Volumes/galaga_mounted/
By: Sarah Edwards | Twitter: @iamevltwin | Email: [email protected]
uname –a OS & Architecture Information $ sudo xmount --in ewf ~/FOR518/galaga.E01 --out dmg /Volumes/galaga_image/
sw_vers macOS Version & Build $ hdiutil attach –nomount /Volumes/galaga_image/galaga.dmg
Directory Commands $ sudo mount_apfs –o rdonly,noexec,noowners /dev/disk# /Volumes/galaga_mounted/
cd .. Change Directory…up one directory (../.. – two directories up) netstat –anf inet or netstat -an Active Network Connections
HFS+ Method 1 – $ mkdir /Volumes/dademurphy_image/
cd Change Directory…to /var/log lsof -i Active Network Connections (by process) xmount $ mkdir /Volumes/dademurphy_mounted/
/var/log netstat -rn Routing Table (xmount v.0.7.*) $ sudo xmount --in ewf ~/FOR518/dademurphy.E01 --out dmg /Volumes/dademurphy_image/
cd ~ Change Directory…to your home directory arp –an | ndp -an ARP Table (IPv4 | IPv6) $ hdiutil attach –nomount /Volumes/dademurphy_image/dademurphy.dmg
cd / Change Directory…to the root directory ifconfig Network Interface Configuration $ mount_hfs –j –o rdonly,noexec,noowners /dev/disk# /Volumes/dademurphy_mounted/
ls List Directory (Short Listing) lsof List Open Files Eject Disk $ diskutil list
ls -l List Directory (Long Listing) $ diskutil eject /dev/disk#
who –a, w List Logged On Users
ls -a List Directory items…including hidden items (files beginning with “.”) $ mount
last List user logins $ sudo umount /Volumes/galaga_image/
ls -lh List Directory items…with human readable sizes ps aux List Processes
ls -R List Directory items…recursively system_profiler -xml System Profiler (XML, Full Detail Level), open with
open . Open Current Directory System Information.app Timestamp Formats
pwd Print Working Directory
-detaillevel full > file.spx
Disk & Partitions APFS 64-bit - Number of Seconds from 1/1/1970 FOR518 - Mac and iOS
mkdir Create a Directory /dev/ Device Directory 00:00:00 UTC Forensic Analysis &
diskutil list List Connected Disks HFS+/MacOS 32-bit - Number of seconds from 1/1/1904
rmdir
rm -r
Remove a Directory
Remove a Directory (and its contents) diskutil info <disk> Disk Information (use Disks /dev/disk#, disk#, or partitions /dev/disk#s#)
00:00:00 UTC Incident Response -
UNIX Epoch 32-bit - Number of seconds from 1/1/1970
. Current Directory diskutil cs|ap list List partitions using CoreStorage (cs) or APFS Containers (ap) 00:00:00 UTC for518.com
.. Parent Directory gpt –r show [-l] List partitions using GUID Partition Table Format (-l to show label rather than Mac Epoch/Mac 32-bit - Number of seconds from 1/1/2001
GUID) – 10.13+ SIP must be disabled. Absolute/Cocoa/WebKit 00:00:00 UTC
File Commands csrutil disable|enable Disable/Enable SIP, must reboot into Recovery Mode (Reboot, Cmd+Option+R)
pico <filename> Open a file in a simple text editor (q – to Property List Dates in Xcode Local Host System Time
mmls <diskimage> Display partitions using The Sleuth Kit
quit editor)
hdiutil imageinfo *.dmg Disk Image Information including Partition Data
xxd <filename> Open a file in a hex editor
hdiutil
Keychains fsid *.dmg Volume Header Information of Disk Image
open <filename> Opens a file in the default program
security list-keychains List Keychains on a system for a logged in user Hostname Directory Command
open –a <programname> <filename> Opens a file in a specified program
cat <filename> Concatenate a file to the terminal screen
security dump-keychains -d <keychain> Dump contents of a Keychain
Extended Attributes Username
<command> | more Pipe command output to more to show
xattr –xl <file> Show Extended Attributes of a file
contents screen by screen
<command> | less Pipe command output to less to show xattr -p <attribute name> <file> | xxd -r -p Extract embedded binary property list from Number of nibble:/ sledwards$ ls -la
contents screen by screen (and be able to >output_file.plist extended attribute. 512-byte total 1014190
go back and forth) istat /dev/disk# <CNID> Use The Sleuth Kit to view file information Blocks Used drwxr-xr-x@ 41 root wheel 1462 Feb 16 21:14 .
rm <filename> Remove File including extended attributes.
icat /dev/disk# <CNID>-<TSK Attribute Number> View a specific extended attribute using The
drwxr-xr-x@ 41 root wheel 1462 Feb 16 21:14 ..
cp <filename> <newfilename> Copy File d--x--x--x+ 8 root wheel 272 Nov 5 01:11 .DocumentRevisions-V100
Sleuth Kit
mv <filename> <newfilename> Move File d-wx-wx-wt 2 root wheel 68 Nov 4 21:05 .Trashes
Log Analysis
<command> > <filename> Redirect command output to a file bzcat system.log.1.bz2 Create a “all-in-one” system.log file. Can also be used with -rw-r--r--+ 1 sledwards admin 312 Mar 9 2013 .apdisk
<command> >> <filename> Append command output to a file system.log.0.bz2 >> system_all.log gzcat for Gzip compressed log files. srwxrwxrwx 1 root wheel 0 Feb 15 21:29 .dbfseventsd
touch <filename> Create an empty file cat system.log >> system_all.log lrwxr-xr-x@ 1 root wheel 11 Sep 23 08:47 etc -> private/etc
head <filename> Show first 10 lines of a file syslog –f <file> | –d <directory> View ASL File or Directory of ASL files
-rwxr-xr-x@ 1 root wheel 8393032 Sep 29 22:39 mach_kernel
tail <filename> Show last 10 lines of a file (-f to watch syslog –T utc –F raw –d Output ASL files the /var/log/asl directory and output in raw
appended input) /var/log/asl format with UTC timestamps.
strings <filename> Show the strings of a file praudit –xn /var/audit/* View audit logs in XML format without user/group resolution.

Ow

Gr
Pe
En

xa

Ha ACL
sudo log collect Create a logarchive bundle on live system, root required

Fi
Fi

La ime
ou
rm

tt
t
exiftool <filename> Show the exif/metadata of the file

le
ne
ry

rd s

le

st st
r/

T
p
View logs in logarchive bundle (use with --predicate to filter)

/D
log show

iss

rN

Si
Ty

Lin

M am
Na
plutil –p <propertylist> Print the contents of a property list

ze
io

ire
pe

od p
am
k
log stream View live logs (use with --predicate to filter)

m
ns

(b
Co

ct
ifi
e

yt
e
file <filename> Show a file signature type

o
ed
un
Time Machine

es

ry
t

)
grep –i <searchterm> <filename> Search for term within a file (case- tmutil uniquesize <machinedirectory_path>/* Show the unique sizes of each snapshot
insensitive) tmutil calculatedrift Show the size changes (added/removed/changed)
python <file>.py Execute a Python program <machinedirectory_path> between each snapshot.
Miscellaneous Commands tmutil compare <snapshotdirectory1> Compare the file changes
GPT Header GPT Reference
Offset Size Field
sudo <command> Execute program as another user (default is root user) <snapshotdirectory2> (added/removed/changed) between two snapshots..
(bytes)
sudo -s Open a privileged shell Memory Analysis & Encrypted Containers GPT Table Entry
vol.py --profile=<profile> -f <memory image> Volatility Usage 0 8 Signature (EFI PART) Offset Size (bytes) Field
su - Substitute User to root
<plugin> 8 4 Revision (1.0) 0 16 Partition Type GUID
whoami / id Display Effective User ID / Show UID/GID Info hdiutil attach –readonly –nomount –stdinpass Mount a FileVault volume using a
12 4 Size of Header (bytes) 16 16 Unique Partition GUID
history Command History filevault2image.dmg password 32 8 Starting LBA (Little Endian)
man <command> Command Manual (q – to exit manual) security unlock-keychain FileVaultMaster.keychain Access and mount a FileVault volume 16 4 Header CRC32
40 8 Ending LBA (Little Endian)
diskutil corestorage unlockvolume <UUID> - using a master password 20 4 Reserved 48 8 Attributes
Terminal Shortcuts
recoverykeychain FileVaultMaster.keychain 56 72 Partition Name
Control + A Jump to beginning of line 24 8 LBA of GPT Header
diskutil corestorage unlockvolume <UUID> -passphrase Mount a FileVault volume using the 128 Rest Reserved
Control + E Jump to end of of line <recovery key> Recovery Key 32 8 LBA of Backup GPT Header
Tab Tab Completion hdiutil attach -readonly -nomount -stdinpass Mount an Encrypted DMG File 40 8 First Usable LBA Type Common GPT Partition GUIDs
Control + C Kill Current Command sekretstuff_USB.dmg 48 8 Last Usable LBA EFI System C12A7328-F81F-11D2-BA4B-00A0C93EC93B
Command + K or Control + L Clear Screen (or clear command) strings <MemoryImage> | sort -u > dictionary.txt Create a dictionary file Partition
56 16 Disk GUID
Command + T New Terminal Tab Spotlight HFS+ Partition 48465300-0000-11AA-AA11-00306543ECAC
72 8 Starting LBA of GUID Partition Table
Command + W Close Terminal Tab
mdls <file> List the Spotlight metadata for a file Apple Boot 426F6F74-0000-11AA-AA11-00306543ECAC
(Little Endian)
Command +/- Increase or Decrease Terminal Font Size
mdfind “<attribute_name> == *” Find files based on a specific metadata query Partition
80 4 Number of Partition Entries Available
mdfind –onlyin /Volumes/mounted_disk Find files only in a certain directory or mounted image. Apple CoreStorage 53746F72-6167-11AA-AA11-00306543ECAC
Option + Left/Right Arrow Move back/forth by word (Little Endian)
mdimport –X | -A Print a list of attributes that can be queried. (possible FileVault
Option + Click in Command Line Put command line cursor where mouse cursor is. 84 4 Size of Partition Entry
or Fusion Drive)
88 4 Partition Entry Array CRC32 APFS Partition 7C3457EF-0000-11AA-AA11-00306543ECAC
Generic Tool Compilation and Installation Disk Arbitration
tar –xvf <archive>.tar.gz sudo launchctl load /System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist Enable 92 Rest Reserved Basic Data Partition EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
./configure sudo launchctl unload /System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist Disable (Boot Camp)
make ps auxw | grep diskarbitrationd Determine Status
sudo make install