{"id":51595171,"url":"https://github.com/securityronin/apfs-forensic","last_synced_at":"2026-07-11T18:01:38.005Z","repository":{"id":366333494,"uuid":"1275905324","full_name":"SecurityRonin/apfs-forensic","owner":"SecurityRonin","description":"Apple File System (APFS) forensic library — from-scratch pure-Rust reader (apfs-core) + anomaly analyzer (apfs-forensic) for container, volume, snapshot, encryption and sealed-volume structures. Panic-free, no runtime deps. Design + scaffold; implementation in progress.","archived":false,"fork":false,"pushed_at":"2026-07-11T00:51:21.000Z","size":445,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-11T02:12:22.190Z","etag":null,"topics":["apfs","apple-file-system","dfir","digital-forensics","file-system","filesystem-forensics","forensics","incident-response","macos","rust"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SecurityRonin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-21T09:38:19.000Z","updated_at":"2026-07-11T00:51:25.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/SecurityRonin/apfs-forensic","commit_stats":null,"previous_names":["securityronin/apfs-forensic"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/SecurityRonin/apfs-forensic","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fapfs-forensic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fapfs-forensic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fapfs-forensic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fapfs-forensic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SecurityRonin","download_url":"https://codeload.github.com/SecurityRonin/apfs-forensic/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SecurityRonin%2Fapfs-forensic/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35370428,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-11T02:00:05.354Z","response_time":104,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apfs","apple-file-system","dfir","digital-forensics","file-system","filesystem-forensics","forensics","incident-response","macos","rust"],"created_at":"2026-07-11T18:01:36.851Z","updated_at":"2026-07-11T18:01:37.997Z","avatar_url":"https://github.com/SecurityRonin.png","language":"Rust","funding_links":["https://github.com/sponsors/h4x0r"],"categories":[],"sub_categories":[],"readme":"# apfs-forensic\n\n[![apfs-core](https://img.shields.io/crates/v/apfs-core.svg?label=apfs-core)](https://crates.io/crates/apfs-core)\n[![apfs-forensic](https://img.shields.io/crates/v/apfs-forensic.svg?label=apfs-forensic)](https://crates.io/crates/apfs-forensic)\n[![Docs.rs](https://img.shields.io/docsrs/apfs-forensic)](https://docs.rs/apfs-forensic)\n[![Rust 1.85+](https://img.shields.io/badge/rust-1.85%2B-orange.svg)](https://www.rust-lang.org)\n[![License: Apache-2.0](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE)\n[![Sponsor](https://img.shields.io/badge/sponsor-h4x0r-ea4aaa?logo=github-sponsors)](https://github.com/sponsors/h4x0r)\n\n[![CI](https://github.com/SecurityRonin/apfs-forensic/actions/workflows/ci.yml/badge.svg)](https://github.com/SecurityRonin/apfs-forensic/actions)\n[![unsafe forbidden](https://img.shields.io/badge/unsafe-forbidden-success.svg)](https://github.com/rust-secure-code/safety-dance)\n[![Security advisories](https://img.shields.io/badge/advisories-clean-success.svg)](deny.toml)\n\n**A from-scratch APFS reader and a graded anomaly auditor — navigate Apple File\nSystem containers, volumes, and snapshots by path, and surface the snapshot and\nsealed-volume tampering, recoverable deleted records, object-map inconsistencies,\nand encryption state that a \"clean\" macOS mount is built to hide.**\n\n\u003e **Status: design skeleton.** The module layout and public API reflect the\n\u003e design at [`docs/plans/2026-06-21-apfs-forensic-design.md`](docs/plans/2026-06-21-apfs-forensic-design.md);\n\u003e parser bodies are stubs pending implementation.\n\nTwo crates, one workspace:\n\n- **[`apfs-core`](https://crates.io/crates/apfs-core)** — the reader: NXSB\n  container + checkpoint ring, object map, B-trees, APSB volumes, file-system\n  records (`j_key`), file extents, extended attributes, snapshots, the space\n  manager, encryption-state, and transparent **decmpfs** decompression over any\n  `Read + Seek` source. No `unsafe`, no C bindings. (Imports as `apfs_core`.)\n- **[`apfs-forensic`](https://crates.io/crates/apfs-forensic)** — the auditor:\n  turns parsed APFS structures into severity-graded\n  [`forensicnomicon::report::Finding`](https://crates.io/crates/forensicnomicon)s,\n  so an APFS volume's anomalies aggregate uniformly with the partition and\n  container layers.\n\n## Audit an APFS container\n\n```toml\n[dependencies]\napfs-forensic = \"0.1\"   # pulls in apfs-core\n```\n\n```rust\nuse apfs_core::ApfsContainer;\nuse apfs_forensic::{audit_container, Source};\nuse forensicnomicon::report::Observation;\n\nlet container = ApfsContainer::open(std::fs::File::open(\"disk.img\")?)?;\nlet src = Source { analyzer: \"apfs-forensic\".into(), scope: \"APFS\".into(), version: None };\n\nfor anomaly in audit_container(\u0026container) {\n    let finding = anomaly.to_finding(src.clone());\n    println!(\"[{:?}] {} — {}\", finding.severity, finding.code, finding.note);\n    // e.g. [Some(High)] APFS-SEALED-VOLUME-BROKEN — im_broken_xid set at xid …\n}\n# Ok::\u003c(), apfs_core::ApfsError\u003e(())\n```\n\n## Trust but verify\n\nPanic-free (`unsafe_code = \"forbid\"`, bounds-checked readers, range-checked\nlength/offset/count fields, capped allocations, cycle-guarded tree walks),\nfuzzed (one cargo-fuzz target per parsed structure + a full-pipeline target), and\nvalidated against **real artifacts** — macOS itself (mount read-only and diff),\nThe Sleuth Kit `fsstat`/`fls`/`istat`, `fsapfsinfo` (libfsapfs), and `apfsck`\n(apfsprogs). See [`docs/validation.md`](docs/validation.md).\n\n---\n\n[Privacy Policy](https://securityronin.github.io/apfs-forensic/privacy/) · [Terms of Service](https://securityronin.github.io/apfs-forensic/terms/) · © 2026 Security Ronin Ltd\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fapfs-forensic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityronin%2Fapfs-forensic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityronin%2Fapfs-forensic/lists"}