Worked on format support

documentation/Apple File System (APFS).asciidoc

@@ -168,7 +168,7 @@ number, relative to the start of the container, is used as the tweak value.
 
 APFS uses the "object" data type to distinguish between different data types.
 
-=== Object header
+=== [[object_header]]Object header
 
 The object header (obj_phys_t) is 32 bytes of size and consists of:
 
@@ -388,6 +388,9 @@ Contains an offset relative to ??? or -1 (0xffff) if not set (invalid)
 | 0x0001 | BTNODE_ROOT | Is root
 | 0x0002 | BTNODE_LEAF | Is leaf
 | 0x0004 | BTNODE_FIXED_KV_SIZE | Has a fixed-size entry (key and value)
+| 0x0008 | BTNODE_HASHED | B-tree branch nodes contain a hash of their sub nodes
+| 0x0010 | BTNODE_NOHEADER | The B-tree node are stored without <<object_header,object header>> +
+The object header contains 0-byte values
 | | |
 | 0x8000 | BTNODE_CHECK_KOFF_INVAL | In transient state +
 This flag is used for in-memory purposes only
@@ -462,6 +465,9 @@ Set to 0 if value has a variable size
 | 0x00000010 | BTREE_PHYSICAL | [yellow-background]*Unknown*
 | 0x00000020 | BTREE_NONPERSISTENT | [yellow-background]*Unknown*
 | 0x00000040 | BTREE_KV_NONALIGNED | [yellow-background]*Unknown*
+| 0x00000080 | BTREE_HASHED | B-tree branch nodes contain a hash of their sub nodes
+| 0x00000100 | BTREE_NOHEADER | The B-tree node are stored without <<object_header,object header>> +
+The object header contains 0-byte values
 |===
 
 == The container

fsapfstools/info_handle.c

@@ -1532,68 +1532,103 @@ int info_handle_uuid_value_fprint(
 	return( -1 );
 }
 
-/* Prints the compatible features flags to the notify stream
+/* Prints the volume compatible features flags to the notify stream
  */
-void info_handle_compatible_features_flags_fprint(
+void info_handle_volume_compatible_features_flags_fprint(
       uint64_t compatible_features_flags,
       FILE *notify_stream )
 {
 	if( ( compatible_features_flags & 0x0000000000000001 ) != 0 )
 	{
 		fprintf(
 		 notify_stream,
-		 "\t\t(NX_FEATURE_DEFRAG)\n" );
+		 "\t\t(APFS_FEATURE_DEFRAG_PRERELEASE)\n" );
 	}
 	if( ( compatible_features_flags & 0x0000000000000002 ) != 0 )
 	{
 		fprintf(
 		 notify_stream,
-		 "\t\t(NX_FEATURE_LCFD)\n" );
+		 "\t\t(APFS_FEATURE_HARDLINK_MAP_RECORDS)\n" );
+	}
+	if( ( compatible_features_flags & 0x0000000000000004 ) != 0 )
+	{
+		fprintf(
+		 notify_stream,
+		 "\t\t(APFS_FEATURE_DEFRAG)\n" );
+	}
+	if( ( compatible_features_flags & 0x0000000000000008 ) != 0 )
+	{
+		fprintf(
+		 notify_stream,
+		 "\t\t(APFS_FEATURE_STRICTATIME)\n" );
+	}
+	if( ( compatible_features_flags & 0x0000000000000010 ) != 0 )
+	{
+		fprintf(
+		 notify_stream,
+		 "\t\t(APFS_FEATURE_VOLGRP_SYSTEM_INO_SPACE)\n" );
 	}
 	fprintf(
 	 notify_stream,
 	 "\n" );
 }
 
-/* Prints the incompatible features flags to the notify stream
+/* Prints the volume incompatible features flags to the notify stream
  */
-void info_handle_incompatible_features_flags_fprint(
+void info_handle_volume_incompatible_features_flags_fprint(
       uint64_t incompatible_features_flags,
       FILE *notify_stream )
 {
 	if( ( incompatible_features_flags & 0x0000000000000001 ) != 0 )
 	{
 		fprintf(
 		 notify_stream,
-		 "\t\t(NX_INCOMPAT_VERSION1)\n" );
+		 "\t\t(APFS_INCOMPAT_CASE_INSENSITIVE)\n" );
 	}
 	if( ( incompatible_features_flags & 0x0000000000000002 ) != 0 )
 	{
 		fprintf(
 		 notify_stream,
-		 "\t\t(NX_INCOMPAT_VERSION2)\n" );
+		 "\t\t(APFS_INCOMPAT_DATALESS_SNAPS)\n" );
 	}
-
-	if( ( incompatible_features_flags & 0x0000000000000100 ) != 0 )
+	if( ( incompatible_features_flags & 0x0000000000000004 ) != 0 )
+	{
+		fprintf(
+		 notify_stream,
+		 "\t\t(APFS_INCOMPAT_ENC_ROLLED)\n" );
+	}
+	if( ( incompatible_features_flags & 0x0000000000000008 ) != 0 )
+	{
+		fprintf(
+		 notify_stream,
+		 "\t\t(APFS_INCOMPAT_NORMALIZATION_INSENSITIVE)\n" );
+	}
+	if( ( incompatible_features_flags & 0x0000000000000010 ) != 0 )
+	{
+		fprintf(
+		 notify_stream,
+		 "\t\t(APFS_INCOMPAT_INCOMPLETE_RESTORE)\n" );
+	}
+	if( ( incompatible_features_flags & 0x0000000000000020 ) != 0 )
 	{
 		fprintf(
 		 notify_stream,
-		 "\t\t(NX_INCOMPAT_FUSION)\n" );
+		 "\t\t(APFS_INCOMPAT_SEALED_VOLUME)\n" );
 	}
 	fprintf(
 	 notify_stream,
 	 "\n" );
 }
 
-/* Prints the read-only compatible features flags to the notify stream
+/* Prints the volume read-only compatible features flags to the notify stream
  */
-void info_handle_read_only_compatible_features_flags_fprint(
+void info_handle_volume_read_only_compatible_features_flags_fprint(
       uint64_t read_only_compatible_features_flags FSAPFSTOOLS_ATTRIBUTE_UNUSED,
       FILE *notify_stream )
 {
 	FSAPFSTOOLS_UNREFERENCED_PARAMETER( read_only_compatible_features_flags )
 
-	/* Currently there are no container read-only compatible feature flags defined */
+	/* Currently there are no volume read-only compatible feature flags defined */
 
 	fprintf(
 	 notify_stream,
@@ -4019,7 +4054,7 @@ int info_handle_volume_fprint(
 	 "\tCompatible features\t\t: 0x%08" PRIx64 "\n",
 	 compatible_features_flags );
 
-	info_handle_compatible_features_flags_fprint(
+	info_handle_volume_compatible_features_flags_fprint(
 	 compatible_features_flags,
 	 info_handle->notify_stream );
 
@@ -4028,7 +4063,7 @@ int info_handle_volume_fprint(
 	 "\tIncompatible features\t\t: 0x%08" PRIx64 "\n",
 	 incompatible_features_flags );
 
-	info_handle_incompatible_features_flags_fprint(
+	info_handle_volume_incompatible_features_flags_fprint(
 	 incompatible_features_flags,
 	 info_handle->notify_stream );
 
@@ -4037,7 +4072,7 @@ int info_handle_volume_fprint(
 	 "\tRead-only compatible features\t: 0x%08" PRIx64 "\n",
 	 read_only_compatible_features_flags );
 
-	info_handle_read_only_compatible_features_flags_fprint(
+	info_handle_volume_read_only_compatible_features_flags_fprint(
 	 read_only_compatible_features_flags,
 	 info_handle->notify_stream );
 

fsapfstools/info_handle.h

@@ -175,15 +175,15 @@ int info_handle_uuid_value_fprint(
      const uint8_t *uuid_data,
      libcerror_error_t **error );
 
-void info_handle_compatible_features_flags_fprint(
+void info_handle_volume_compatible_features_flags_fprint(
       uint64_t compatible_features_flags,
       FILE *notify_stream );
 
-void info_handle_incompatible_features_flags_fprint(
+void info_handle_volume_incompatible_features_flags_fprint(
       uint64_t incompatible_features_flags,
       FILE *notify_stream );
 
-void info_handle_read_only_compatible_features_flags_fprint(
+void info_handle_volume_read_only_compatible_features_flags_fprint(
       uint64_t read_only_compatible_features_flags,
       FILE *notify_stream );
 

libfsapfs/libfsapfs_btree_footer.c

@@ -147,7 +147,6 @@ int libfsapfs_btree_footer_read_data(
 
 #if defined( HAVE_DEBUG_OUTPUT )
 	uint64_t value_64bit  = 0;
-	uint32_t value_32bit  = 0;
 #endif
 
 	if( btree_footer == NULL )
@@ -196,6 +195,10 @@ int libfsapfs_btree_footer_read_data(
 		 LIBCNOTIFY_PRINT_DATA_FLAG_GROUP_DATA );
 	}
 #endif
+	byte_stream_copy_to_uint32_little_endian(
+	 ( (fsapfs_btree_footer_t *) data )->flags,
+	 btree_footer->flags );
+
 	byte_stream_copy_to_uint32_little_endian(
 	 ( (fsapfs_btree_footer_t *) data )->node_size,
 	 btree_footer->node_size );
@@ -219,15 +222,12 @@ int libfsapfs_btree_footer_read_data(
 #if defined( HAVE_DEBUG_OUTPUT )
 	if( libcnotify_verbose != 0 )
 	{
-		byte_stream_copy_to_uint32_little_endian(
-		 ( (fsapfs_btree_footer_t *) data )->flags,
-		 value_32bit );
 		libcnotify_printf(
 		 "%s: flags\t\t\t\t\t: 0x%08" PRIx32 "\n",
 		 function,
-		 value_32bit );
+		 btree_footer->flags );
 		libfsapfs_debug_print_btree_flags(
-		 value_32bit );
+		 btree_footer->flags );
 		libcnotify_printf(
 		 "\n" );
 

libfsapfs/libfsapfs_btree_footer.h

@@ -35,6 +35,10 @@ typedef struct libfsapfs_btree_footer libfsapfs_btree_footer_t;
 
 struct libfsapfs_btree_footer
 {
+	/* The flags
+	 */
+	uint32_t flags;
+
 	/* The node size
 	 */
 	uint32_t node_size;

libfsapfs/libfsapfs_debug.c

@@ -74,6 +74,16 @@ void libfsapfs_debug_print_btree_flags(
 		libcnotify_printf(
 		 "\t(BTREE_KV_NONALIGNED)\n" );
 	}
+	if( ( btree_flags & 0x00000080 ) != 0 )
+	{
+		libcnotify_printf(
+		 "\t(BTREE_HASHED)\n" );
+	}
+	if( ( btree_flags & 0x00000100 ) != 0 )
+	{
+		libcnotify_printf(
+		 "\tHas no object header (BTREE_NOHEADER)\n" );
+	}
 }
 
 /* Prints the B-tree node flags
@@ -96,6 +106,16 @@ void libfsapfs_debug_print_btree_node_flags(
 		libcnotify_printf(
 		 "\tHas fixed-size entry (BTNODE_FIXED_KV_SIZE)\n" );
 	}
+	if( ( btree_node_flags & 0x0008 ) != 0 )
+	{
+		libcnotify_printf(
+		 "\t(BTNODE_HASHED)\n" );
+	}
+	if( ( btree_node_flags & 0x0010 ) != 0 )
+	{
+		libcnotify_printf(
+		 "\t(BTNODE_NOHEADER)\n" );
+	}
 
 	if( ( btree_node_flags & 0x8000 ) != 0 )
 	{