Code Monkey home page Code Monkey logo

apfs-fuse's People

Contributors

a-wai avatar sconaway avatar sgan81 avatar titokhan avatar ydkhatri avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

apfs-fuse's Issues

syntax error: "(" unexpected

when i run
# sh apfs-fuse /dev/sda2 /mnt/mydisk

i have in output the follow message:

apfs-fuse: 1 apfs-fuse: syntax error: "(" unexpected

can you help me please? i downloaded with git clone.
best regards

Easy way to make some spurious warnings go away

I always get worried when I see warning messages like this fly by:

/local/src/sys/apfs-fuse-master/ApfsLib/BTree.cpp:508:35: warning: ‘rc’ may be used uninitialized in this function [-Wmaybe-uninitialized]
res = (rc > 0) ? mid : (mid + 1);

Looking at the code, I see that (assuming cnt can't be < 0) they are spurious, and if my version of gcc was smarter, it wouldn't output them.

However, they will go away (at least in gcc v 5.5.0) if you change
if (cnt == 0)
return -1;
to
if (cnt < 1)
return -1;

This also protects against the possibly-can-never-and-should-never-happen case of cnt < 0.

Thanks for your efforts on this!

Error on make: recipe for target 'all' failed

I'm trying to install on Ubuntu 16.04. Getting this errors after calling make:

/home/kvadrug/Documents/APFS-fuse/apfs-fuse/apfsfuse/ApfsFuse.cpp:23:23: fatal error: fuse/fuse.h: No such file or directory
compilation terminated.
apfsfuse/CMakeFiles/apfs-fuse.dir/build.make:65: recipe for target 'apfsfuse/CMakeFiles/apfs-fuse.dir/ApfsFuse.o' failed
make[2]: *** [apfsfuse/CMakeFiles/apfs-fuse.dir/ApfsFuse.o] Error 1
make[2]: Leaving directory '/home/kvadrug/Documents/APFS-fuse/apfs-fuse/build'
CMakeFiles/Makefile2:1274: recipe for target 'apfsfuse/CMakeFiles/apfs-fuse.dir/all' failed
make[1]: *** [apfsfuse/CMakeFiles/apfs-fuse.dir/all] Error 2
make[1]: Leaving directory '/home/kvadrug/Documents/APFS-fuse/apfs-fuse/build'
Makefile:86: recipe for target 'all' failed
make: *** [all] Error 2

This tools saved my life

Somehow my mac crashed, and when i boot it with ubuntu live cd the APFS volumes obviously aren't readable natively, used the tool helped me a lot.

Input/output error

Trying to access files contained within a .app file generates an Input/output error. This is what debugging shows:

apfs_lookup: ino=1 name=root => OK
apfs_stat_internal => OK
apfs_lookup: ino=2 name=Users => OK
apfs_stat_internal => OK
apfs_lookup: ino=6691D name=username => OK
apfs_stat_internal => OK
apfs_lookup: ino=6D4A8 name=Downloads => OK
apfs_stat_internal => OK
apfs_lookup: ino=6D4AB name=Email Archiver Pro.app => OK
apfs_stat_internal => OK
apfs_lookup: ino=100180F09 name=Contents => OK
apfs_stat_internal => OK
apfs_lookup: ino=100180F0A name=Info.plist => OK
GetAttribute: type=11
parsing as a link
size=379 size_on_disk=1000
inode says size=0 size_on_disk=0
dumping attribute link data
0000: 66 0F 18 00 01 00 00 00 79 03 00 00 00 00 00 00 - f.......y.......
0010: 00 10 00 00 00 00 00 00 04 00 00 00 00 00 00 00 - ................
0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................
ReadFile for inode 100180F66, offset=0
key->inode=8000000100180F66; key->offset=0
val->size=100000000001000; val->block=19EBB7; val->crypto_id=19EBB7
key has offset 0
val has block=19EBB7, size=1000
reading at offset 0 length 1000 starting from block 19EBB7 (extent starts at block 19EBB7)
dumping start of attribute content
0000: 66 70 6D 63 03 00 00 00 18 0B 00 00 00 00 00 00 - fpmc............
Compressed size B18 bytes.
apfs_stat_internal => OK
apfs_open: 100180F65
GetAttribute: type=11
parsing as a link
size=379 size_on_disk=1000
inode says size=0 size_on_disk=0
dumping attribute link data
0000: 66 0F 18 00 01 00 00 00 79 03 00 00 00 00 00 00 - f.......y.......
0010: 00 10 00 00 00 00 00 00 04 00 00 00 00 00 00 00 - ................
0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - ................
ReadFile for inode 100180F66, offset=0
key->inode=8000000100180F66; key->offset=0
val->size=100000000001000; val->block=19EBB7; val->crypto_id=19EBB7
key has offset 0
val has block=19EBB7, size=1000
reading at offset 0 length 1000 starting from block 19EBB7 (extent starts at block 19EBB7)
dumping start of attribute content
0000: 66 70 6D 63 03 00 00 00 18 0B 00 00 00 00 00 00 - fpmc............
Inode info: size=0, size_on_disk=0
DecompressFile 379 => B18, algo = 3
Expected B18 bytes in compressed stream, got 0

This also occurred with other .app files but not all of the ones in the image.

Any ideas?

Thank you!

Failed to Compile

I installed:
cmake
fuse
icu
cmake-rpm-macros
cmake-gui
extra-cmake-modules
libattr-devel
libicu-devel

But when I try to compile it on Fedora KDE 27, it fails to compile.

[ 89%] Building CXX object apfsfuse/CMakeFiles/apfs-fuse.dir/ApfsFuse.cpp.o
cd /home/uit/apfs-fuse/build/apfsfuse && /usr/bin/c++ -D_FILE_OFFSET_BITS=64 -I/home/uit/apfs-fuse/. -Wall -Wextra -march=native -std=gnu++11 -o CMakeFiles/apfs-fuse.dir/ApfsFuse.cpp.o -c /home/uit/apfs-fuse/apfsfuse/ApfsFuse.cpp
/home/uit/apfs-fuse/apfsfuse/ApfsFuse.cpp:22:10: fatal error: fuse/fuse.h: No such file or directory
#include <fuse/fuse.h>
^~~~~~~~~~~~~
compilation terminated.
make[2]: *** [apfsfuse/CMakeFiles/apfs-fuse.dir/build.make:66: apfsfuse/CMakeFiles/apfs-fuse.dir/ApfsFuse.cpp.o] Error 1
make[2]: Leaving directory '/home/uit/apfs-fuse/build'
make[1]: *** [CMakeFiles/Makefile2:254: apfsfuse/CMakeFiles/apfs-fuse.dir/all] Error 2
make[1]: Leaving directory '/home/uit/apfs-fuse/build'
make: *** [Makefile:87: all] Error 2

segmentation fault (core dumped)

I managed to compile apfs-fuse successfully, but when run with command
sudo apfs-fuse /dev/sdb /mnt/osx
it returns the error
Segmentation fault (core dumped)
any ideas where I should begin to get this tool working?
Itś running on Linux Mint 18.3.

Strange freeze in DADiskCreateFromVolumePath

When I launch from Xcode, it freeze in DADiskCreateFromVolumePath. If I put a sleep of 200 nano seconds just before, it works (I guess the time needed is machine dependant). To do that, I have to recompile fuse library, of course.
Don't know if it's a Fuse issue or a missing initialisation before fuse_mount in AppFuse.cpp, or a race condition.

Block Device

Hi there,
Thanks again for this tool, works great!
Would it be possible to create a block device file like dislocker does with dislocker-file and libewf does with ewf1 in addition to creating a mount directory?

Thanks!!

nid 226f7173f733a52b xid 3d NOT FOUND!!!

# fdisk -l
Device           Start       End   Sectors   Size Type
/dev/loop5p1        40    409639    409600   200M EFI System
/dev/loop5p2    409640 488965175 488555536   233G Apple Core storage
/dev/loop5p3 488965176 490234711   1269536 619.9M Apple boot
# apfs-fuse -d 10 /dev/loop5p2 /media/temp2/
Device /dev/loop5p2 opened. Size is 250140434432
nid 226f7173f733a52b xid 3d NOT FOUND!!!
Unable to get volume!

What's wrong?

Install libfuse before using make

Hello,

I get following error while executing make:

#include fuse/fuse.h not found

Please add following to Readme

sudo apt install libfuse-dev

Thank you for your work

Stefan

"Error opening device!"

I have installed all the tools as other users hav suggested in other issues and compiled without errors, but there is an error:

sudo  apfs-fuse /dev/sdc/ /media/ubuntu/
Opening device /dev/sdc/ failed. Not a directory
Error opening device!

I have also tried sdc1 and sdc2.

Here's the list of disks:

sdc              7.3G                                   
├─sdc2           7.1G                                   
└─sdc1 vfat      200M                                   EFI

My APFS disk is an USB Drive.

Not able to install on ubuntu 16.04

Hi,

I am not able install this on ubuntu 16.04. I am getting following error.

cd /home/ubuntu/apfs-fuse/build/apfsfuse && /usr/bin/c++ -D_FILE_OFFSET_BITS=64 -I/home/ubuntu/apfs-fuse/. -std=c++11 -Wall -Wextra -march=native -O3 -DNDEBUG -std=gnu++11 -o CMakeFiles/apfs-fuse.dir/ApfsFuse.o -c /home/ubuntu/apfs-fuse/apfsfuse/ApfsFuse.cpp
/home/ubuntu/apfs-fuse/apfsfuse/ApfsFuse.cpp:29:24: fatal error: attr/xattr.h: No such file or directory
compilation terminated.
apfsfuse/CMakeFiles/apfs-fuse.dir/build.make:65: recipe for target 'apfsfuse/CMakeFiles/apfs-fuse.dir/ApfsFuse.o' failed
make[2]: *** [apfsfuse/CMakeFiles/apfs-fuse.dir/ApfsFuse.o] Error 1
make[2]: Leaving directory '/home/ubuntu/apfs-fuse/build'
CMakeFiles/Makefile2:253: recipe for target 'apfsfuse/CMakeFiles/apfs-fuse.dir/all' failed
make[1]: *** [apfsfuse/CMakeFiles/apfs-fuse.dir/all] Error 2
make[1]: Leaving directory '/home/ubuntu/apfs-fuse/build'
Makefile:86: recipe for target 'all' failed
make: *** [all] Error 2

Raspberry Pi / ARM compatibility

Hi! Awesome project :)

I'm trying to build it on Raspbian, but I'm getting a bunch of errors on lzvn_decode.s. There's a possibility of ARM compatibility?
Thanks!

Possible semantic typo

I read the code out of curiosity and spotted this:

st.st_atimespec.tv_sec = rec.ino.ctime / div_nsec;
st.st_atimespec.tv_nsec = rec.ino.ctime % div_nsec;

I suppose it should be

 st.st_atimespec.tv_sec = rec.ino.atime / div_nsec; 
 st.st_atimespec.tv_nsec = rec.ino.atime % div_nsec; 

Segmentation fault.

Hello all,

I am running a 4.15 kernel on Debian Stretch. The machine is a Macbook Pro mid-2017 15 inch retina.

libfuse-dev (2.9.7-1)
ibicu-dev (57.1-8)
icu-devtools (57.1-8)

Apfs-fuse worked up to a week ago mounting APFS container(s) on linux in R/O mode. Compliments on your efforts.

A week is a long time in Linux, after a few apt-get update sessions, apfs-fuse is no longer working (segmentation fault) -

apfs-fuse /dev/nvme0n1p2 /uu
Segmentation fault

GDB output:

gdb apfs-fuse

(gdb) set args /dev/nvme0n1p2 /uu
(gdb) run

Starting program: /Transit/apfs-fuse-master/build/bin/apfs-fuse /dev/nvme0n1p2 /uu
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x000055555556be3e in BTreeNode::level (this=0x0) at /Transit/apfs-fuse-master/ApfsLib/BTree.h:79
79 uint16_t level() const { return m_bt->level; }

(gdb) backtrace
#0 0x000055555556be3e in BTreeNode::level (this=0x0) at /Transit/apfs-fuse-master/ApfsLib/BTree.h:79
#1 0x000055555556a523 in BTree::Lookup (this=0x55555579d538, result=..., key=0x7fffffffdf30, key_size=16, func=0x555555560b0e <CompareNodeMapKey(void const*, size_t, void const*, size_t, void*)>,
context=0x55555579c538, exact=false) at /Transit/apfs-fuse-master/ApfsLib/BTree.cpp:211
#2 0x0000555555560e63 in ApfsNodeMapperBTree::GetBlockID (this=0x55555579c538, info=..., nodeid=1027, version=54073) at /Transit/apfs-fuse-master/ApfsLib/ApfsNodeMapperBTree.cpp:89
#3 0x000055555555ce8f in ApfsContainer::GetVolume (this=0x55555579be70, index=0) at /Transit/apfs-fuse-master/ApfsLib/ApfsContainer.cpp:98
#4 0x000055555555ad10 in main (argc=3, argv=0x7fffffffe148) at /Transit/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:594

Hope the above information is sufficient. Any further questions, please let me know.

Regards,

JC

PS

I ran the the apfs-dump-quick diagnostic (apfs-dump-quick /dev/nvme0n1p2 nvme0n1p2.txt), this itself went down with a segmentation fault. The file is too big to upload here,
nvme0n1p2.txt
here is an excerpt, hope we are lucky on what I have redacted.

relative path

If mountpoint is a relative path, fuse hangs in fuse_mount. It freezes in DADiskCreateFromVolumePath (helper.c, line 285).

Using Mac OS High Sierra and latest fuse from github.

Bravo for your work.

Bruteforce FileVault Encryption?

I've been getting into forensics and penetration testing lately and hoping you can help me understand what the below data is and how it might be used to perform a bruteforce attacks.

More specifically, what is "VEK Wrpd", "KEK Wrpd", "HMAC", and "PW Key"? And can they be used to reproduce the FileVault password if it's guessed correctly?

$ ./apfs-fuse -d 16 /dev/sda2/ /path/to/mount

Device /dev/sda2 opened. Size is 250790436864
starting LoadKeybag
 all blocks verified
 header has type 6b657973
Volume macOS1 is encrypted.
Password hint: looking for key type 3 for volume 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251 in m_container_bag
Trying to load key bag from recs_block
starting LoadKeybag
 all blocks verified
 header has type 72656373
Password hint: looking for key type 4 for volume 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251 in recs_bag
Enter Password: 
GetVolumeKey: Dumping container keybag.
Dumping Keybag (keys)

Version :    2
Keys    :    2
Bytes   :       e0

Key 0:
UUID    : 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251
Type    :    3 [Keybag Ref]
Length  :   10
Unknown :        0

Block   :           7c1f57
Count   :                1

Key 1:
UUID    : 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251
Type    :    2 [VEK]
Length  :   7c
Unknown :        0

[Blob Header]
Unk 80  : 0
HMAC    : 106BXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX9921
Salt    : 5493XXXXXXXX1F47

[VEK]
Unk 80  : 0
UUID    : 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251
Unk 82  :        0    1 9e b1
VEK Wrpd: 06391FA9XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX552582F2



GetVolumeKey: looking for key type 3 for volume 1342XXXX-XXXX-XXXX-XXXX-XXXXXXXX4251 in m_container_bag
 key found
 data size matches that of key_extent_t
Trying to load key bag from recs_block
starting LoadKeybag
 all blocks verified
 header has type 72656373
Volume key bag loaded successfully. Dumping contents.
Dumping Keybag (recs)

Version :    2
Keys    :    3
Bytes   :      220

Key 0:
UUID    : 257AXXXX-XXXX-XXXX-XXXX-XXXXXXXX7975
Type    :    3 [KEK]
Length  :   94
Unknown :        0

[Blob Header]
Unk 80  : 0
HMAC    : F047XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXF6A8
Salt    : 630CXXXXXXXX268

[KEK]
Unk 80  : 0
UUID    : 257AXXXX-XXXX-XXXX-XXXX-XXXXXXXX7975
Unk 82  :        0    2 9e b1
KEK Wrpd: BB7FXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX07F8
Iterat's: 100000
Salt    : 863CXXXXXXXXXXXXXXXXXXXXXXXX2F51

    
Key 1:
UUID    : CDF5XXXX-XXXX-XXXX-XXXX-XXXXXXXXE4CA
Type    :    3 [KEK]
Length  :   94
Unknown :        0

[Blob Header]
Unk 80  : 0
HMAC    : 5A2AXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXAEB8
Salt    : BFBFXXXXXXXX5FD6

[KEK]
Unk 80  : 0
UUID    : CDF5XXXX-XXXX-XXXX-XXXX-XXXXXXXXE4CA
Unk 82  :        0    2 9e b1
KEK Wrpd: 43A8XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX5E07
Iterat's: 117590
Salt    : 8751XXXXXXXXXXXXXXXXXXXXXXXXB0DA


Key 2:
UUID    : EBC6XXXX-XXXX-XXXX-XXXX-XXXXXXXXECAC
Type    :    3 [KEK]
Length  :   94
Unknown :        0

[Blob Header]
Unk 80  : 0
HMAC    : 9F92XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX5706
Salt    : E363XXXXXXXXCC09

[KEK]
Unk 80  : 0
UUID    : EBC6XXXX-XXXX-XXXX-XXXX-XXXXXXXXECAC
Unk 82  :        0    2 9e b1
KEK Wrpd: CF35XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXEC04
Iterat's: 127270
Salt    : 3780XXXXXXXXXXXXXXXXXXXXXXXXA2E7



PW Key  : EE62XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX6AB5
KEK Wrpd: BB7FXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX07F8
KEK     : A60EXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX4D78
KEK IV  : F7ECXXXXXXXX202A

PW Key  : 6363XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX6191
KEK Wrpd: 43A8XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX5E07
KEK     : EB9FXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXD6F9
KEK IV  : 5932XXXXXXXX4ACB

PW Key  : 6B62XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXEEFF
KEK Wrpd: CF35XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXEC04
KEK     : B579XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXAD90
KEK IV  : A3E7XXXXXXXXCA4F

fatal error: stdint.h: No such file or directory

I'm trying to compile this on Debian using cmake but whenever I run the the 'make' command, I receive the below compile error:-

username@my_system:~/apfs-fuse/build$ sudo make
/usr/bin/cmake -H/home/secuser/apfs-fuse -B/home/secuser/apfs-fuse/build --check-build-system CMakeFiles/Makefile.cmake 0
/usr/bin/cmake -E cmake_progress_start /home/secuser/apfs-fuse/build/CMakeFiles /home/secuser/apfs-fuse/build/CMakeFiles/progress.marks
make -f CMakeFiles/Makefile2 all
make[1]: Entering directory '/home/secuser/apfs-fuse/build'
make -f ApfsLib/CMakeFiles/ApfsLib.dir/build.make ApfsLib/CMakeFiles/ApfsLib.dir/depend
make[2]: Entering directory '/home/secuser/apfs-fuse/build'
cd /home/secuser/apfs-fuse/build && /usr/bin/cmake -E cmake_depends "Unix Makefiles" /home/secuser/apfs-fuse /home/secuser/apfs-fuse/ApfsLib /home/secuser/apfs-fuse/build /home/secuser/apfs-fuse/build/ApfsLib /home/secuser/apfs-fuse/build/ApfsLib/CMakeFiles/ApfsLib.dir/DependInfo.cmake --color=
make[2]: Leaving directory '/home/secuser/apfs-fuse/build'
make -f ApfsLib/CMakeFiles/ApfsLib.dir/build.make ApfsLib/CMakeFiles/ApfsLib.dir/build
make[2]: Entering directory '/home/secuser/apfs-fuse/build'
[  3%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/Aes.cpp.o
cd /home/secuser/apfs-fuse/build/ApfsLib && /usr/bin/c++    -I/home/secuser/apfs-fuse/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/Aes.cpp.o -c /home/secuser/apfs-fuse/ApfsLib/Aes.cpp
In file included from /home/secuser/apfs-fuse/ApfsLib/Aes.cpp:1:0:
/usr/lib/gcc/x86_64-linux-gnu/6/include/stdint.h:9:26: fatal error: stdint.h: No such file or directory
 # include_next <stdint.h>
                          ^
compilation terminated.
ApfsLib/CMakeFiles/ApfsLib.dir/build.make:65: recipe for target 'ApfsLib/CMakeFiles/ApfsLib.dir/Aes.cpp.o' failed
make[2]: *** [ApfsLib/CMakeFiles/ApfsLib.dir/Aes.cpp.o] Error 1
make[2]: Leaving directory '/home/secuser/apfs-fuse/build'
CMakeFiles/Makefile2:88: recipe for target 'ApfsLib/CMakeFiles/ApfsLib.dir/all' failed
make[1]: *** [ApfsLib/CMakeFiles/ApfsLib.dir/all] Error 2
make[1]: Leaving directory '/home/secuser/apfs-fuse/build'
Makefile:86: recipe for target 'all' failed
make: *** [all] Error 2

Iterate the DMG archive contents.

Hi,

I wonder if it’s possible to read the dmg contents using this project as a standalone version, without the need for fuse wrapper ? Where should I look for the relevant API’s for that ?

Suspicious lowercasing logic used to compute file name hashes

I noticed that the lowercasing logic in the file hash code had a hard-coded 0x500-element array, and decided to try and make a contradicting test case.

hdiutil create -megabytes 1 -layout GPTSPUD -fs apfs -volname unicode-name-edge-cases unicode-name-edge-cases.dmg
hdiutil attach unicode-name-edge-cases.dmg
# U+1EE2 = Latin Capital Letter O With Horn And Dot Below
touch /Volumes/unicode-name-edge-cases/$'\xE1\xBB\xA2'_$'\xE1\xBB\xA2'
# U+1EE3 = Latin Small Letter O With Horn And Dot Below
touch /Volumes/unicode-name-edge-cases/$'\xE1\xBB\xA3'_$'\xE1\xBB\xA3'
ls -l /Volumes/unicode-name-edge-cases

Output for me was like this:

drwx------  3 tester  staff   96 15 Mar 11:00 .fseventsd
-rw-r--r--  1 tester  staff    0 15 Mar 11:01 Ợ_Ợ

This confirms that characters above 0x500 are also lowercased.
Now I'm doing further investigation to see just how high it goes.

Can't mount by UUID

I don't know whether this should work or not, but I can't get the drive to mount either on the command line or in fstab using UUID=

bash-4.4$ sudo mount -t apfs /dev/sda6 /data
bash-4.4$ ls /data
private-dir  root
bash-4.4$ sudo umount /data
bash-4.4$ sudo blkid /dev/sda6
/dev/sda6: PARTLABEL="HFS" PARTUUID="652d4643-b47d-4281-b09e-e0533a558190"
bash-4.4$ sudo mount -t apfs UUID=652d4643-b47d-4281-b09e-e0533a558190 /data
mount: /data: can't find UUID=652d4643-b47d-4281-b09e-e0533a558190.

Not a huge issue, but I thought I would report it.

"-march=native" causes build failure on PPC64

Not that it's super important to be able to build on PPC64 for this filesystem type, nonetheless, this error shows up when building on PPC64, and it looks easy enough to fix (removing it from the list of CFLAGS in CMakeLists.txt):

cc1plus: error: unrecognized command line option '-march=native'

Reorganize repository

Have a proposal to put these files
Aes.cpp
Aes.h
AesXts.cpp
AesXts.h
Crypto.cpp
Crypto.h
Des.cpp
Des.h
Sha1.cpp
Sha1.h
Sha256.cpp
Sha256.h
TripleDes.cpp
TripleDes.h
and probably these two
Crc32.cpp
Crc32.h

to a subfolder named "crypto" or "decrypt".

Thanks

Unable to get volume

Hey I asked that question on stackexchange in which I already assumed that the filesystem from my mac might be broke. anyway the comment suggested to use your tool.

following the calls like #3 I am not successful

Device /dev/sda opened. Size is 3000592982016
Found valid GPT partition table. Looking for APFS partition.
Unable to get volume! 

Do you have any suggestions? in any case #16 also holds for me. I consider myself not bad with computers but reverse engineering a file system and publishing the work is really great and far out of my skillset.

best Rene

Driver crashes/stops after trying to read files from APFS volume

The following script listing text files in a directory and then trying to dump their contents in console causes the apfs-fuse to crash. Looks like the driver fails soon after files are being read.

I reconfirmed through another C++ application, the behavior is the same. Soon after files are read, apfs-fuse shuts down.

Note that directory traversal works fine, the find command below properly returns a long list of files.
Crash happens sometime into the cat loop.

fileList=$(find /mnt/apfsDir/root -name "*.txt")

for file in $fileList ; do
    cat $file
done

Terminal access

Thanks for taking the time to create this, the project works great and is a real life saver. The only thing I'd like is control of the terminal (and if I'm being ambitions, a descriptive message) after the volume gets mounted successfully. Thanks in advance!

Fragmented files, FileVault, recovery keys and more

Hello!

Simon, thanks for this awesome FUSE driver.

Opening this issue to discuss pull request #21 . If it's too big or there are other problems, I'm happy to split it up or to fix the problems :)

Copying here the content of the main deltas for convenience:

  1. Allow mounting of FileVault-encrypted APFS volumes, as opposed to regular encrypted volumes;
  2. Allow decryption through a (personal, not institutional) recovery key, as opposed to a regular password;
  3. Fix decryption when an extent's crypto_id does not match the block number;
  4. Fix reading fragmented files;
  5. Fix decompression for several algos, especially the handling of uncompressed blocks;
  6. Provide a "strict" mode that returns errors when decompression fails;
  7. Minor enhancements (allow spaces in passwords; allow specifying a container offset, which is handy when working with raw disk images).

List container volumes (feature request)

It would be nice to have a switch to just list the volumes found in an APFS container without mounting them. Something like MacOS diskutil list, with name and size.

Device container format

Hi, pardon my ignorance, but what format should the device be in?

I've tried for example these: /dev/sdx, /dev/sdx2, sdx, sdx2, ...
But I can't seem to mount it correctly.

On my computer, if I try this: ./apfs-fuse -v 2 -d 1 /dev/sdb /mnt/my_drive
it says:
Device /dev/sdb opened. Size is 1000727379968 bytes.
Segmentation fault (core dumped)

I am trying to mount /dev/sdb on my machine.

Any help would be appreciated! Thank you so much.

Segmentation fault

fdisk -l /dev/sda
Disk /dev/sda: 111.8 GiB, 120034123776 bytes, 234441648 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: CFD0A84A-432E-4B84-A831-0BDCE634E061

Device         Start       End   Sectors  Size Type
/dev/sda1       2048     34815     32768   16M Microsoft reserved
/dev/sda2      67584    579583    512000  250M EFI System
/dev/sda3   10772480 102928383  92155904   44G unknown
/dev/sda4  102928384 234440703 131512320 62.7G Microsoft basic data

Reading symbols from apfs-fuse...done.
(gdb) set args -d1 /dev/sda3 /mnt/osx
(gdb) run
Starting program: /root/Downloads/Compressed/apfs-fuse-master/build/bin/apfs-fuse -d1 /dev/sda3 /mnt/osx
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Device /dev/sda3 opened. Size is 47183822848 bytes.

Program received signal SIGSEGV, Segmentation fault.
0x000055555556be2e in BTreeNode::level (this=0x0)
    at /root/Downloads/Compressed/apfs-fuse-master/ApfsLib/BTree.h:79
79		uint16_t level() const { return m_bt->level; }
(gdb) backtrace
#0  0x000055555556be2e in BTreeNode::level (this=0x0)
    at /root/Downloads/Compressed/apfs-fuse-master/ApfsLib/BTree.h:79
#1  0x000055555556a513 in BTree::Lookup (this=0x55555579d948, result=..., 
    key=0x7fffffffde10, key_size=16, 
    func=0x555555560b04 <CompareNodeMapKey(void const*, size_t, void const*, size_t, void*)>, context=0x55555579c948, exact=false)
    at /root/Downloads/Compressed/apfs-fuse-master/ApfsLib/BTree.cpp:211
#2  0x0000555555560e59 in ApfsNodeMapperBTree::GetBlockID (
    this=0x55555579c948, info=..., nodeid=1027, version=25187)
    at /root/Downloads/Compressed/apfs-fuse-master/ApfsLib/ApfsNodeMapperBTree.cpp:89
#3  0x000055555555ce85 in ApfsContainer::GetVolume (this=0x55555579c280, 
    index=0)
    at /root/Downloads/Compressed/apfs-fuse-master/ApfsLib/ApfsContainer.cpp:98
#4  0x000055555555ad06 in main (argc=4, argv=0x7fffffffe028)
    at /root/Downloads/Compressed/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:594
(gdb) 

Build for distribution?

I've received a request to add this to SIFT but we require that tools be installed through some standard fashion. This could be a file download, deb install, etc ..

Would you be interested in maintain releases on this repository and building a deb package for debian based systems like ubuntu?

Thank you.

Doesn't compile, dependency specificiation incomplete

I had to install in addition to what was listed:
libc6-dev
libfuse-dev
libicu-dev
build-essentials
cmake

And create a symlink to /usr/include/attr/xattr.h from what libc6-dev provided. Still didn't compile.

Environment: Debian Testing in Macbook Air 13"
Linux version 4.14.0-debian-amd64 ([email protected]) (gcc version 7.2.0 (Debian 7.2.0-18))

~/a/build # make
/usr/bin/cmake -H/root/apfs-fuse-master -B/root/apfs-fuse-master/build --check-build-system CMakeFiles/Makefile.cmake 0
/usr/bin/cmake -E cmake_progress_start /root/apfs-fuse-master/build/CMakeFiles /root/apfs-fuse-master/build/CMakeFiles/progress.marks
make -f CMakeFiles/Makefile2 all
make[1]: Entering directory '/root/apfs-fuse-master/build'
make -f ApfsLib/CMakeFiles/ApfsLib.dir/build.make ApfsLib/CMakeFiles/ApfsLib.dir/depend
make[2]: Entering directory '/root/apfs-fuse-master/build'
cd /root/apfs-fuse-master/build && /usr/bin/cmake -E cmake_depends "Unix Makefiles" /root/apfs-fuse-master /root/apfs-fuse-master/ApfsLib /root/apfs-fuse-master/build /root/apfs-fuse-master/build/ApfsLib /root/apfs-fuse-master/build/ApfsLib/CMakeFiles/ApfsLib.dir/DependInfo.cmake --color=
Scanning dependencies of target ApfsLib
make[2]: Leaving directory '/root/apfs-fuse-master/build'
make -f ApfsLib/CMakeFiles/ApfsLib.dir/build.make ApfsLib/CMakeFiles/ApfsLib.dir/build
make[2]: Entering directory '/root/apfs-fuse-master/build'
[  3%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/Aes.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/Aes.cpp.o -c /root/apfs-fuse-master/ApfsLib/Aes.cpp
[  7%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/AesXts.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/AesXts.cpp.o -c /root/apfs-fuse-master/ApfsLib/AesXts.cpp
[ 10%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/ApfsContainer.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/ApfsContainer.cpp.o -c /root/apfs-fuse-master/ApfsLib/ApfsContainer.cpp
[ 14%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/ApfsDir.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/ApfsDir.cpp.o -c /root/apfs-fuse-master/ApfsLib/ApfsDir.cpp
/root/apfs-fuse-master/ApfsLib/ApfsDir.cpp: In static member function ‘static int ApfsDir::CompareStdDirKey(const void*, size_t, const void*, size_t, void*)’:
/root/apfs-fuse-master/ApfsLib/ApfsDir.cpp:391:91: warning: unused parameter ‘ekey_len’ [-Wunused-parameter]
 int ApfsDir::CompareStdDirKey(const void *skey, size_t skey_len, const void *ekey, size_t ekey_len, void *context)
                                                                                           ^~~~~~~~
[ 17%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/ApfsNodeMapper.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/ApfsNodeMapper.cpp.o -c /root/apfs-fuse-master/ApfsLib/ApfsNodeMapper.cpp
[ 21%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/ApfsNodeMapperBTree.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/ApfsNodeMapperBTree.cpp.o -c /root/apfs-fuse-master/ApfsLib/ApfsNodeMapperBTree.cpp
/root/apfs-fuse-master/ApfsLib/ApfsNodeMapperBTree.cpp: In function ‘int CompareNodeMapKey(const void*, size_t, const void*, size_t, void*)’:
/root/apfs-fuse-master/ApfsLib/ApfsNodeMapperBTree.cpp:27:55: warning: unused parameter ‘skey_len’ [-Wunused-parameter]
 static int CompareNodeMapKey(const void *skey, size_t skey_len, const void *ekey, size_t ekey_len, void *context)
                                                       ^~~~~~~~
/root/apfs-fuse-master/ApfsLib/ApfsNodeMapperBTree.cpp:27:90: warning: unused parameter ‘ekey_len’ [-Wunused-parameter]
 static int CompareNodeMapKey(const void *skey, size_t skey_len, const void *ekey, size_t ekey_len, void *context)
                                                                                          ^~~~~~~~
[ 25%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/ApfsVolume.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/ApfsVolume.cpp.o -c /root/apfs-fuse-master/ApfsLib/ApfsVolume.cpp
[ 28%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/BlockDumper.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/BlockDumper.cpp.o -c /root/apfs-fuse-master/ApfsLib/BlockDumper.cpp
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp: In member function ‘void BlockDumper::DumpBTEntry_0_E(const byte_t*, size_t, const byte_t*, size_t, bool)’:
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:335:11: warning: variable ‘nlen’ set but not used [-Wunused-but-set-variable]
  uint16_t nlen;
           ^~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp: In member function ‘void BlockDumper::DumpBTEntry_4_B(const byte_t*, size_t, const byte_t*, size_t, bool)’:
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:654:66: warning: unused parameter ‘key_length’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_4_B(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                  ^~~~~~~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:654:109: warning: unused parameter ‘value_length’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_4_B(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                                                             ^~~~~~~~~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp: In member function ‘void BlockDumper::DumpBTEntry_4_F(const byte_t*, size_t, const byte_t*, size_t, bool)’:
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:682:66: warning: unused parameter ‘key_length’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_4_F(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                  ^~~~~~~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:682:109: warning: unused parameter ‘value_length’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_4_F(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                                                             ^~~~~~~~~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp: In member function ‘void BlockDumper::DumpBTEntry_4_10(const byte_t*, size_t, const byte_t*, size_t, bool)’:
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:712:67: warning: unused parameter ‘key_length’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_4_10(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                   ^~~~~~~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:712:110: warning: unused parameter ‘value_length’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_4_10(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                                                              ^~~~~~~~~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp: In member function ‘void BlockDumper::DumpBTEntry_4_13(const byte_t*, size_t, const byte_t*, size_t, bool)’:
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:770:67: warning: unused parameter ‘key_length’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_4_13(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                   ^~~~~~~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:770:110: warning: unused parameter ‘value_length’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_4_13(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                                                              ^~~~~~~~~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:770:129: warning: unused parameter ‘index’ [-Wunused-parameter]
 oid BlockDumper::DumpBTEntry_4_13(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                                                                                ^~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp: In member function ‘void BlockDumper::DumpBTEntry_8_9(const byte_t*, size_t, const byte_t*, size_t, bool)’:
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:777:66: warning: unused parameter ‘key_length’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_8_9(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                  ^~~~~~~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:777:109: warning: unused parameter ‘value_length’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_8_9(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                                                             ^~~~~~~~~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:777:128: warning: unused parameter ‘index’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_8_9(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                                                                                ^~~~~
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp: In member function ‘void BlockDumper::DumpBTEntry_Unk(const byte_t*, size_t, const byte_t*, size_t, bool)’:
/root/apfs-fuse-master/ApfsLib/BlockDumper.cpp:793:128: warning: unused parameter ‘index’ [-Wunused-parameter]
 void BlockDumper::DumpBTEntry_Unk(const byte_t * key_ptr, size_t key_length, const byte_t * val_ptr, size_t value_length, bool index)
                                                                                                                                ^~~~~
[ 32%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/BTree.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/BTree.cpp.o -c /root/apfs-fuse-master/ApfsLib/BTree.cpp
/root/apfs-fuse-master/ApfsLib/BTree.cpp: In member function ‘int BTree::FindBin(const std::shared_ptr<BTreeNode>&, const void*, size_t, BTCompareFunc, void*, BTree::FindMode)’:
/root/apfs-fuse-master/ApfsLib/BTree.cpp:495:2: warning: ‘res’ may be used uninitialized in this function [-Wmaybe-uninitialized]
  if (res == cnt)
  ^~
/root/apfs-fuse-master/ApfsLib/BTree.cpp:482:19: warning: ‘mid’ may be used uninitialized in this function [-Wmaybe-uninitialized]
   res = (rc <= 0) ? mid : (mid - 1);
         ~~~~~~~~~~^~~~~~~~~~~~~~~~~
/root/apfs-fuse-master/ApfsLib/BTree.cpp:473:36: warning: ‘rc’ may be used uninitialized in this function [-Wmaybe-uninitialized]
   std::cout << " => " << resstr[rc + 1] << ", " << mid;
                                 ~~~^~~
[ 35%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/Crc32.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/Crc32.cpp.o -c /root/apfs-fuse-master/ApfsLib/Crc32.cpp
[ 39%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/Crypto.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/Crypto.cpp.o -c /root/apfs-fuse-master/ApfsLib/Crypto.cpp
[ 42%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/Decmpfs.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/Decmpfs.cpp.o -c /root/apfs-fuse-master/ApfsLib/Decmpfs.cpp
/root/apfs-fuse-master/ApfsLib/Decmpfs.cpp: In function ‘bool DecompressFile(ApfsDir&, uint64_t, std::vector<unsigned char>&, const std::vector<unsigned char>&)’:
/root/apfs-fuse-master/ApfsLib/Decmpfs.cpp:143:12: warning: unused variable ‘rsrc_size’ [-Wunused-variable]
   uint32_t rsrc_size = bswap_32(*reinterpret_cast<uint32_t *>(rsrc.data() + rsrc_hdr.data_off_be));
            ^~~~~~~~~
[ 46%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/Device.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/Device.cpp.o -c /root/apfs-fuse-master/ApfsLib/Device.cpp
[ 50%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/DeviceLinux.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/DeviceLinux.cpp.o -c /root/apfs-fuse-master/ApfsLib/DeviceLinux.cpp
[ 53%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/Inflate.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/Inflate.cpp.o -c /root/apfs-fuse-master/ApfsLib/Inflate.cpp
/root/apfs-fuse-master/ApfsLib/Inflate.cpp: In member function ‘size_t Inflate::Decompress(uint8_t*, size_t, const uint8_t*, size_t)’:
/root/apfs-fuse-master/ApfsLib/Inflate.cpp:282:6: warning: variable ‘nlen’ set but not used [-Wunused-but-set-variable]
  int nlen;
      ^~~~
[ 57%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/KeyMgmt.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/KeyMgmt.cpp.o -c /root/apfs-fuse-master/ApfsLib/KeyMgmt.cpp
/root/apfs-fuse-master/ApfsLib/KeyMgmt.cpp: In member function ‘bool KeyParser::GetBytes(uint8_t, uint8_t*, size_t)’:
/root/apfs-fuse-master/ApfsLib/KeyMgmt.cpp:137:22: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
  if ((m_end - m_ptr) < len)
      ~~~~~~~~~~~~~~~~^~~~~
/root/apfs-fuse-master/ApfsLib/KeyMgmt.cpp: In member function ‘bool KeyParser::GetAny(uint8_t, bagdata_t&)’:
/root/apfs-fuse-master/ApfsLib/KeyMgmt.cpp:158:22: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
  if ((m_end - m_ptr) < len)
      ~~~~~~~~~~~~~~~~^~~~~
/root/apfs-fuse-master/ApfsLib/KeyMgmt.cpp: In member function ‘bool Keybag::Init(const uint8_t*, size_t)’:
/root/apfs-fuse-master/ApfsLib/KeyMgmt.cpp:204:48: warning: unused parameter ‘size’ [-Wunused-parameter]
 bool Keybag::Init(const uint8_t * data, size_t size)
                                                ^~~~
[ 60%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/Sha256.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/Sha256.cpp.o -c /root/apfs-fuse-master/ApfsLib/Sha256.cpp
[ 64%] Building CXX object ApfsLib/CMakeFiles/ApfsLib.dir/Util.cpp.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/ApfsLib.dir/Util.cpp.o -c /root/apfs-fuse-master/ApfsLib/Util.cpp
[ 67%] Building ASM object ApfsLib/CMakeFiles/ApfsLib.dir/lzvn_decode.s.o
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/cc  -I/root/apfs-fuse-master/.  -O3 -DNDEBUG   -o CMakeFiles/ApfsLib.dir/lzvn_decode.s.o -c /root/apfs-fuse-master/ApfsLib/lzvn_decode.s
[ 71%] Linking CXX static library ../lib/libApfsLib.a
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/cmake -P CMakeFiles/ApfsLib.dir/cmake_clean_target.cmake
cd /root/apfs-fuse-master/build/ApfsLib && /usr/bin/cmake -E cmake_link_script CMakeFiles/ApfsLib.dir/link.txt --verbose=1
/usr/bin/ar qc ../lib/libApfsLib.a  CMakeFiles/ApfsLib.dir/Aes.cpp.o CMakeFiles/ApfsLib.dir/AesXts.cpp.o CMakeFiles/ApfsLib.dir/ApfsContainer.cpp.o CMakeFiles/ApfsLib.dir/ApfsDir.cpp.o CMakeFiles/ApfsLib.dir/ApfsNodeMapper.cpp.o CMakeFiles/ApfsLib.dir/ApfsNodeMapperBTree.cpp.o CMakeFiles/ApfsLib.dir/ApfsVolume.cpp.o CMakeFiles/ApfsLib.dir/BlockDumper.cpp.o CMakeFiles/ApfsLib.dir/BTree.cpp.o CMakeFiles/ApfsLib.dir/Crc32.cpp.o CMakeFiles/ApfsLib.dir/Crypto.cpp.o CMakeFiles/ApfsLib.dir/Decmpfs.cpp.o CMakeFiles/ApfsLib.dir/Device.cpp.o CMakeFiles/ApfsLib.dir/DeviceLinux.cpp.o CMakeFiles/ApfsLib.dir/Inflate.cpp.o CMakeFiles/ApfsLib.dir/KeyMgmt.cpp.o CMakeFiles/ApfsLib.dir/Sha256.cpp.o CMakeFiles/ApfsLib.dir/Util.cpp.o CMakeFiles/ApfsLib.dir/lzvn_decode.s.o
/usr/bin/ranlib ../lib/libApfsLib.a
make[2]: Leaving directory '/root/apfs-fuse-master/build'
[ 71%] Built target ApfsLib
make -f ApfsDump/CMakeFiles/apfs-dump.dir/build.make ApfsDump/CMakeFiles/apfs-dump.dir/depend
make[2]: Entering directory '/root/apfs-fuse-master/build'
cd /root/apfs-fuse-master/build && /usr/bin/cmake -E cmake_depends "Unix Makefiles" /root/apfs-fuse-master /root/apfs-fuse-master/ApfsDump /root/apfs-fuse-master/build /root/apfs-fuse-master/build/ApfsDump /root/apfs-fuse-master/build/ApfsDump/CMakeFiles/apfs-dump.dir/DependInfo.cmake --color=
Scanning dependencies of target apfs-dump
make[2]: Leaving directory '/root/apfs-fuse-master/build'
make -f ApfsDump/CMakeFiles/apfs-dump.dir/build.make ApfsDump/CMakeFiles/apfs-dump.dir/build
make[2]: Entering directory '/root/apfs-fuse-master/build'
[ 75%] Building CXX object ApfsDump/CMakeFiles/apfs-dump.dir/Apfs.cpp.o
cd /root/apfs-fuse-master/build/ApfsDump && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/apfs-dump.dir/Apfs.cpp.o -c /root/apfs-fuse-master/ApfsDump/Apfs.cpp
/root/apfs-fuse-master/ApfsDump/Apfs.cpp: In function ‘void ctrl_c_handler(int)’:
/root/apfs-fuse-master/ApfsDump/Apfs.cpp:148:32: warning: unused parameter ‘sig’ [-Wunused-parameter]
 static void ctrl_c_handler(int sig)
                                ^~~
[ 78%] Linking CXX executable ../bin/apfs-dump
cd /root/apfs-fuse-master/build/ApfsDump && /usr/bin/cmake -E cmake_link_script CMakeFiles/apfs-dump.dir/link.txt --verbose=1
/usr/bin/c++   -Wall -Wextra -march=native -O3 -DNDEBUG   CMakeFiles/apfs-dump.dir/Apfs.cpp.o  -o ../bin/apfs-dump ../lib/libApfsLib.a -licuuc 
make[2]: Leaving directory '/root/apfs-fuse-master/build'
[ 78%] Built target apfs-dump
make -f Test/CMakeFiles/apfs-dump-quick.dir/build.make Test/CMakeFiles/apfs-dump-quick.dir/depend
make[2]: Entering directory '/root/apfs-fuse-master/build'
cd /root/apfs-fuse-master/build && /usr/bin/cmake -E cmake_depends "Unix Makefiles" /root/apfs-fuse-master /root/apfs-fuse-master/Test /root/apfs-fuse-master/build /root/apfs-fuse-master/build/Test /root/apfs-fuse-master/build/Test/CMakeFiles/apfs-dump-quick.dir/DependInfo.cmake --color=
Scanning dependencies of target apfs-dump-quick
make[2]: Leaving directory '/root/apfs-fuse-master/build'
make -f Test/CMakeFiles/apfs-dump-quick.dir/build.make Test/CMakeFiles/apfs-dump-quick.dir/build
make[2]: Entering directory '/root/apfs-fuse-master/build'
[ 82%] Building CXX object Test/CMakeFiles/apfs-dump-quick.dir/Test.cpp.o
cd /root/apfs-fuse-master/build/Test && /usr/bin/c++   -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/apfs-dump-quick.dir/Test.cpp.o -c /root/apfs-fuse-master/Test/Test.cpp
[ 85%] Linking CXX executable ../bin/apfs-dump-quick
cd /root/apfs-fuse-master/build/Test && /usr/bin/cmake -E cmake_link_script CMakeFiles/apfs-dump-quick.dir/link.txt --verbose=1
/usr/bin/c++   -Wall -Wextra -march=native -O3 -DNDEBUG   CMakeFiles/apfs-dump-quick.dir/Test.cpp.o  -o ../bin/apfs-dump-quick ../lib/libApfsLib.a -licuuc 
make[2]: Leaving directory '/root/apfs-fuse-master/build'
[ 85%] Built target apfs-dump-quick
make -f apfsfuse/CMakeFiles/apfs-fuse.dir/build.make apfsfuse/CMakeFiles/apfs-fuse.dir/depend
make[2]: Entering directory '/root/apfs-fuse-master/build'
cd /root/apfs-fuse-master/build && /usr/bin/cmake -E cmake_depends "Unix Makefiles" /root/apfs-fuse-master /root/apfs-fuse-master/apfsfuse /root/apfs-fuse-master/build /root/apfs-fuse-master/build/apfsfuse /root/apfs-fuse-master/build/apfsfuse/CMakeFiles/apfs-fuse.dir/DependInfo.cmake --color=
Scanning dependencies of target apfs-fuse
make[2]: Leaving directory '/root/apfs-fuse-master/build'
make -f apfsfuse/CMakeFiles/apfs-fuse.dir/build.make apfsfuse/CMakeFiles/apfs-fuse.dir/build
make[2]: Entering directory '/root/apfs-fuse-master/build'
[ 89%] Building CXX object apfsfuse/CMakeFiles/apfs-fuse.dir/ApfsFuse.cpp.o
cd /root/apfs-fuse-master/build/apfsfuse && /usr/bin/c++  -D_FILE_OFFSET_BITS=64 -I/root/apfs-fuse-master/.  -Wall -Wextra -march=native -O3 -DNDEBUG   -std=gnu++11 -o CMakeFiles/apfs-fuse.dir/ApfsFuse.cpp.o -c /root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp: In function ‘void apfs_bmap(fuse_req_t, fuse_ino_t, size_t, uint64_t)’:
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:170:34: warning: unused parameter ‘req’ [-Wunused-parameter]
 static void apfs_bmap(fuse_req_t req, fuse_ino_t ino, size_t blocksize, uint64_t idx)
                                  ^~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:170:50: warning: unused parameter ‘ino’ [-Wunused-parameter]
 static void apfs_bmap(fuse_req_t req, fuse_ino_t ino, size_t blocksize, uint64_t idx)
                                                  ^~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:170:62: warning: unused parameter ‘blocksize’ [-Wunused-parameter]
 static void apfs_bmap(fuse_req_t req, fuse_ino_t ino, size_t blocksize, uint64_t idx)
                                                              ^~~~~~~~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:170:82: warning: unused parameter ‘idx’ [-Wunused-parameter]
 static void apfs_bmap(fuse_req_t req, fuse_ino_t ino, size_t blocksize, uint64_t idx)
                                                                                  ^~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp: In function ‘void apfs_destroy(void*)’:
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:175:32: warning: unused parameter ‘userdata’ [-Wunused-parameter]
 static void apfs_destroy(void *userdata)
                                ^~~~~~~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp: In function ‘void apfs_getattr(fuse_req_t, fuse_ino_t, fuse_file_info*)’:
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:180:74: warning: unused parameter ‘fi’ [-Wunused-parameter]
 static void apfs_getattr(fuse_req_t req, fuse_ino_t ino, fuse_file_info *fi)
                                                                          ^~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp: In function ‘void apfs_getxattr(fuse_req_t, fuse_ino_t, const char*, size_t)’:
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:216:23: error: ‘ENOATTR’ was not declared in this scope
   fuse_reply_err(req, ENOATTR);
                       ^~~~~~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:216:23: note: suggested alternative: ‘ENOSTR’
   fuse_reply_err(req, ENOATTR);
                       ^~~~~~~
                       ENOSTR
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp: In function ‘void apfs_read(fuse_req_t, fuse_ino_t, size_t, off_t, fuse_file_info*)’:
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:371:11: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
   if (off >= file->decomp_data.size())
       ~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp: In function ‘int reply_buf_limited(fuse_req_t, const char*, size_t, off_t, size_t)’:
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:398:10: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
  if (off < bufsize)
      ~~~~^~~~~~~~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp: In function ‘void apfs_statfs(fuse_req_t, fuse_ino_t)’:
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:486:36: warning: unused parameter ‘req’ [-Wunused-parameter]
 static void apfs_statfs(fuse_req_t req, fuse_ino_t ino)
                                    ^~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:486:52: warning: unused parameter ‘ino’ [-Wunused-parameter]
 static void apfs_statfs(fuse_req_t req, fuse_ino_t ino)
                                                    ^~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp: At global scope:
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:497:17: warning: ‘apfs_opfs’ defined but not used [-Wunused-variable]
 static fuse_opt apfs_opfs[] =
                 ^~~~~~~~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:486:13: warning: ‘void apfs_statfs(fuse_req_t, fuse_ino_t)’ defined but not used [-Wunused-function]
 static void apfs_statfs(fuse_req_t req, fuse_ino_t ino)
             ^~~~~~~~~~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:175:13: warning: ‘void apfs_destroy(void*)’ defined but not used [-Wunused-function]
 static void apfs_destroy(void *userdata)
             ^~~~~~~~~~~~
/root/apfs-fuse-master/apfsfuse/ApfsFuse.cpp:170:13: warning: ‘void apfs_bmap(fuse_req_t, fuse_ino_t, size_t, uint64_t)’ defined but not used [-Wunused-function]
 static void apfs_bmap(fuse_req_t req, fuse_ino_t ino, size_t blocksize, uint64_t idx)
             ^~~~~~~~~
apfsfuse/CMakeFiles/apfs-fuse.dir/build.make:65: recipe for target 'apfsfuse/CMakeFiles/apfs-fuse.dir/ApfsFuse.cpp.o' failed
make[2]: *** [apfsfuse/CMakeFiles/apfs-fuse.dir/ApfsFuse.cpp.o] Error 1
make[2]: Leaving directory '/root/apfs-fuse-master/build'
CMakeFiles/Makefile2:253: recipe for target 'apfsfuse/CMakeFiles/apfs-fuse.dir/all' failed
make[1]: *** [apfsfuse/CMakeFiles/apfs-fuse.dir/all] Error 2
make[1]: Leaving directory '/root/apfs-fuse-master/build'
Makefile:86: recipe for target 'all' failed
make: *** [all] Error 2
⏎          

Device not found!

Running:
$ ./apfs-fuse -d 1 /dev/sda2 /home/ajenbo/cmbp
results in:

Device not found!

I have verified that the partition-type is 7c3457ef-0000-11aa-aa11-00306543ecac

Unnecessary dependency on libattr xattr.h.

glibc version of the xattr.h header is more universally present, and nearly identical save an alias of ENOATTR for ENODATA. Recommend utilizing the glibc header for fewer dependencies which may not be easy to fulfill on all distributions. See #53 for a pull request.

Rescuing an APFS partition

I got the error message "unable to get volume!", but with different details from the other thread. I posted an extensive report of the problem I am trying to solve, and my attempts to fix it, on the Ubuntu forums:

https://ubuntuforums.org/showthread.php?t=2393046#post13771507

In my most recent attempt, I used dd again to extract just the APFS partition from the disk image (into file partition6.dmg), and then tried apfs-fuse again:

$ sudo ./apfs-fuse -r passphrase -l /media/jonathan/untitled1/partition6.dmg /media/mountpoint/
nid c0f995b6fda590f9 xid a192d26f90a27374 NOT FOUND!!!
Unable to get volume!

Any help you could give would be so appreciated! If you look on the Ubuntu Forum post, I have tried a whole bunch of things.

problems installing, no unicode/utypes.h

Hi,

I am trying to compile from source but I am getting the error below when building object ApfsLib/CMakeFiles/ApfsLib.dir/Util.o

fatal error: unicode/utypes.h: No such file or directory
#include <unicode/utypes.h>

I have attached a file with the entire output of make.

What do I have to do to fix it?

I am trying to build it on linux mint 19.
make.log

Install libbz2 before using make

Hello,

I get following error while making your driver:

#include <bzlib.h>
^~~~~~~~~

Add to Readme:

sudo apt-get install libbz2-1.0 libbz2-dev

Unknown Inode Attribute 2203/2003/203 when reading files

Looking at logs after trying to copy a lot of files, I'm seeing lots of messages like this:
WARNING!!!: Unknown Inode Attribute 2203 at inode ...
WARNING!!!: Unknown Inode Attribute 2003 at inode ...
WARNING!!!: Unknown Inode Attribute 203 at inode ...

Also apfs-dump-quick spit out a bunch of these:
!!! UNKNOWN NODE TYPE 2147483666 in block ...

Just want to say thanks!

You saved my bacon tonight! I had a APFS based volume on sparse bundle on a exfat USB drive, and only a linux machine on-hand, and I was able to get my files out of it using apfs-fuse and sparsebundlefs and fuse-exfat.

For future readers benefit: I had to create a loopback mount as the actual APFS data was offset. The sparsebundlefs README shows how.

Again, thank you so much! I am really relieved!

ApfsDir::ReadFile strange assert

What does this assert mean?

assert((size & 0xFFF) == 0);

It fails for most files (currently trying to extract a file which size is 3436)

Install libattr before using make

Hello,

I currently get following error while executing make

attr/xattr.h not found

Please add to Readme:

sudo apt-get install libattr1-dev

Nice greeting

Stefan

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.