Created
April 4, 2018 05:08
-
-
Save hakanai/4fb21c7e873a8feeff1b6c131043ff6e to your computer and use it in GitHub Desktop.
Some APFS file attribute structures
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Some directory: | |
| 01 00 00 00 00 00 00 00 parent node ID | |
| 02 00 00 00 00 00 00 00 our node ID | |
| 12 13 b0 25 44 1a 22 15 time created | |
| 29 28 23 65 45 1a 22 15 time modified | |
| 29 28 23 65 45 1a 22 15 time changed | |
| 12 13 b0 25 44 1a 22 15 time accessed | |
| 00 80 00 00 00 00 00 00 0x8000 = flags | |
| 03 00 00 00 3 = link count (in this case dir entry count) | |
| 00 00 00 00 0 = UNKNOWN | |
| 04 00 00 00 4 = UNKNOWN | |
| 00 00 00 00 BSD flags | |
| f5 01 00 00 501 = uid | |
| 14 00 00 00 20 = gid | |
| ed 41 0x4 = item type (regular file), 0x1ED = POSIX mode (oct 0755) | |
| 00 00 00 00 00 00 00 00 00 00 UNKNOWN | |
| 01 00 entry count | |
| 08 00 length of variable section | |
| 04 02 05 00 entry 1, type(?) = 0x0204, length = 0x5 | |
| 72 6f 6f 74 00 contents of entry 1, "root\0" | |
| 00 00 00 padding to 8-byte boundary | |
| Some normal file with contents: | |
| 10 00 00 00 00 00 00 00 parent node ID | |
| 11 00 00 00 00 00 00 00 our node ID | |
| 52 33 c7 5f 44 1a 22 15 time created | |
| 78 0e a6 6e 45 1a 22 15 time modified | |
| b6 5c 2a 6f 45 1a 22 15 time changed | |
| 78 0e a6 6e 45 1a 22 15 time accessed | |
| 00 80 00 00 00 00 00 00 0x8000 = flags | |
| 01 00 00 00 1 = link count | |
| 00 00 00 00 0 = UNKNOWN | |
| 03 00 00 00 3 = UNKNOWN | |
| 00 00 00 00 BSD flags | |
| 63 00 00 00 99 = uid | |
| 63 00 00 00 99 = gid | |
| 80 81 0x8 = item type (regular file), 0x180 = POSIX mode (oct 0600) | |
| 00 00 00 00 00 00 00 00 00 00 UNKNOWN | |
| 02 00 entry count | |
| 38 00 length of variable section | |
| 04 02 0f 00 entry 1, type(?) = 0x0204, length = 0xf | |
| 08 20 28 00 entry 2, type(?) = 0x2008, length = 0x28 | |
| 66 73 65 76 65 6e 74 73 64 2d 75 75 69 64 00 contents of entry 1, "fsevents-uuid\0" | |
| 00 padding to 8-byte boundary | |
| 24 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 contents of entry 2, mystery | |
| 00 00 00 00 00 00 00 00 24 00 00 00 00 00 00 00 | |
| 00 00 00 00 00 00 00 00 | |
| A symbolic link: | |
| 02 00 00 00 00 00 00 00 parent node ID | |
| 11 00 00 00 00 00 00 00 our node ID | |
| da cc 6a 6d 41 fe 1f 15 time created | |
| da cc 6a 6d 41 fe 1f 15 time modified | |
| da cc 6a 6d 41 fe 1f 15 time changed | |
| da cc 6a 6d 41 fe 1f 15 time accessed | |
| 00 80 00 00 00 00 00 00 0x8000 = flags | |
| 01 00 00 00 1 = link count | |
| 00 00 00 00 0 = UNKNOWN | |
| 01 00 00 00 1 = UNKNOWN | |
| 00 00 00 00 BSD flags | |
| 63 00 00 00 99 = uid | |
| 63 00 00 00 99 = gid | |
| ed a1 0xA = item type (symbolic link), 0x1ED = POSIX mode (oct 0755) | |
| 00 00 00 00 00 00 00 00 00 00 UNKNOWN | |
| 01 00 entry count | |
| 08 00 length of variable section | |
| 04 02 08 00 entry 1, type(?) = 0x0204, length = 0x8 | |
| 73 79 6d 6c 69 6e 6b 00 contents of entry 1, "symlink\0" | |
| A character device: | |
| 02 00 00 00 00 00 00 00 parent node ID | |
| 12 00 00 00 00 00 00 00 our node ID | |
| 5b 28 d8 62 45 1a 22 15 time created | |
| 5b 28 d8 62 45 1a 22 15 time modified | |
| 5b 28 d8 62 45 1a 22 15 time changed | |
| 5b 28 d8 62 45 1a 22 15 time accessed | |
| 00 80 00 00 00 00 00 00 0x8000 = flags | |
| 01 00 00 00 1 = link count | |
| 04 00 00 00 4 = UNKNOWN | |
| 01 00 00 00 1 = UNKNOWN | |
| 00 00 00 00 BSD flags | |
| 63 00 00 00 99 = uid | |
| 63 00 00 00 99 = gid | |
| a4 21 0x2 = item type (character device), 0x1A4 = POSIX mode (oct 0644) | |
| 00 00 00 00 00 00 00 00 00 00 UNKNOWN | |
| 02 00 entry count | |
| 18 00 length of variable section | |
| 04 02 0c 00 entry 1, type(?) = 0x0204, length = 0xc | |
| 0e 22 04 00 entry 2, type(?) = 0x220e, length = 0x4 | |
| 63 68 61 72 2d 64 65 76 69 63 65 00 contents of entry 1, "char-device\0" | |
| 00 00 00 00 padding to 8-byte boundary | |
| 27 00 00 04 contents of entry 2, device major 4, minor 39 | |
| 00 00 00 00 padding to 8-byte boundary | |
| A block device: | |
| 02 00 00 00 00 00 00 00 parent node ID | |
| 13 00 00 00 00 00 00 00 our node ID | |
| d8 17 23 65 45 1a 22 15 time created | |
| d8 17 23 65 45 1a 22 15 time modified | |
| d8 17 23 65 45 1a 22 15 time changed | |
| d8 17 23 65 45 1a 22 15 time accessed | |
| 00 80 00 00 00 00 00 00 0x8000 = flags | |
| 01 00 00 00 1 = link count | |
| 04 00 00 00 4 = UNKNOWN | |
| 01 00 00 00 1 = UNKNOWN | |
| 00 00 00 00 BSD flags | |
| 63 00 00 00 99 = uid | |
| 63 00 00 00 99 = gid | |
| a4 61 0x6 = item type (block device), 0x1A4 = POSIX mode (oct 0644) | |
| 00 00 00 00 00 00 00 00 00 00 UNKNOWN | |
| 02 00 entry count | |
| 18 00 length of variable section | |
| 04 02 0d 00 entry 1, type(?) = 0x0204, length = 0xd | |
| 0e 22 04 00 entry 2, type(?) = 0x220e, length = 0x4 | |
| 62 6c 6f 63 6b 2d 64 65 76 69 63 65 00 contents of entry 1, "block-device\0" | |
| 00 00 00 padding to 8-byte boundary | |
| 09 00 00 01 contents of entry 2, device major 1, minor 9 | |
| 00 00 00 00 padding to 8-byte boundary | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment