libfsapfs is a library to access the Apple File System (APFS).

Project information:

* Status: experimental
* Licence: LGPLv3+

Read-only supported APFS formats:

* version 2

Supported APFS format features:

* ZLIB (DEFLATE) compression
* LZVN compression
* encryption

Unsupported APFS format features:

* APFS version 1
* Fusion drive (NX_INCOMPAT_FUSION)
* snapshots
* LZFSE compression, compression methods 11 and 12
* "uncompressed", compression methods 1, 9 and 10
* T2 encryption

Library and tools to access the New Technology File System (NTFS).

Note that this project currently only focuses on the analysis of the format.

Library to provide generic file value functions for the libyal family of libraries.

Library to provide Windows NT data type support for the libyal family of libraries.
libyal is typically used in digital forensic tools.

Library to access the Windows Shell Item format for the libyal family of libraries.
libyal is typically used in digital forensic tools.

A library to support various Hash-based Message Authentication Codes
(HMAC).

Library to access the Windows Shortcut File (LNK) Format files.

Library and tooling to access the QEMU Copy-On-Write (QCOW) image format.

Library to access Windows Registry Files. Typically used by computer forensics applications.

libsmdev is a library to access and read storage media devices.

libsmraw is a library to access the storage media RAW format.
The library supports both RAW and split RAW.

libuna is a library to support Unicode and ASCII (byte string) conversions. It currently supports: 7-bit ASCII, ISO 8859-{1..15}, Windows 874, 932, 936, 949, 950, 1250, 1251, 1252, 1253, 1254, 1255, 1256, 1257, 1258, KOI8-R, KOI8-U, UTF-7, UTF-8, UTF-16, UTF-32.

Library and tools to access the Virtual Hard Disk (VHD) image format.

Read supported formats:

VHD version 1
- Supported image types:

Fixed-size hard disk image
- Dynamic-size (or sparse) hard disk image
- Differential (or differencing) hard disk image
- Note that an undo disk image (.vud) is also a differential image

Library and tools to access the VMware Virtual Disk (VMDK) image format.

Read supported extent file formats:
- RAW (flat)
- COWD version 1 (sparse)
- VMDK version 1, 2 and 3 (sparse)

Supported VMDK format features:
- delta links
- grain compression (as of version 20131209)
- data markers (as of version 20140416)

VMDK format features not supported at the moment:
- images that use a physical device
- changed block tracking (CBT) (supported by VMDK version 3 (sparse)) / change tracking filek

Library and tools to access the Volume Shadow Snapshot (VSS) format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume.

The package includes 2 support docs:

OSDFC 2012: Paper - Windowless Shadow Snapshots
OSDFC 2012: Slides - Windowless Shadow Snapshots