Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add APFS support #2211

Closed
5 tasks done
joachimmetz opened this issue Nov 23, 2018 · 1 comment
Closed
5 tasks done

Add APFS support #2211

joachimmetz opened this issue Nov 23, 2018 · 1 comment
Assignees
Labels
core Issues relating to Plaso's core - processing, file access etc. enhancement New or improved functionality

Comments

@joachimmetz
Copy link
Member

joachimmetz commented Nov 23, 2018

Add support to plaso to handle APFS containers and volumes.

Also see log2timeline/dfvfs#314

@joachimmetz joachimmetz added enhancement New or improved functionality core Issues relating to Plaso's core - processing, file access etc. labels Nov 23, 2018
@joachimmetz joachimmetz self-assigned this Nov 23, 2018
@joachimmetz joachimmetz added this to the 2018 December Release milestone Nov 24, 2018
@joachimmetz
Copy link
Member Author

joachimmetz commented Dec 2, 2018

Issues that surfaced during test run with #2217 and log2timeline/dfvfs#347

           Message : unable to process path specification with error:
                     'APFSFileEntry' object has no attribute 'type'
      Parser chain : 
Path specification : type: OS, location: drfalken_system.E01
                   : type: EWF
                   : type: TSK_PARTITION, location: /p2, part index: 5, start
                     offset: 0x0c805000
                   : type: APFS_CONTAINER, location: /apfs1, volume index: 0
                   : type: APFS, identifier: 173894, location: /Network

Culprit https://github.com/log2timeline/plaso/blob/master/plaso/engine/worker.py#L638 .type that should be a .type_indicator. Adding a fix to #2217

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
core Issues relating to Plaso's core - processing, file access etc. enhancement New or improved functionality
Projects
None yet
Development

No branches or pull requests

1 participant