HFSleuth - Unknown compression type: 3

[forestcorgi]

Your past self wishes to inform you of an unknown compression type while pulling files from a decrypted iOS root filesystem.

[morpheus]

Which IPSW was that? It's a quick fix.

(APFS support for HFSleuth coming soon, too

[matt]

Hi. Is there any documentation about the differences between the supported compression types? type1/3/4/12 etc

Are they different compression schemes altogether?

Thanks!

[morpheus]

Yes, in the kernel's bsd/sys/decmpfs.h. Problem is the rest are in AppleFSCompression, which is closed source. The types I saw are

Code: Select all

  switch (CompressionType)
        {

                case 4:  // Older style, still present in iOS 9
                  ..
                case 8: // Newer, apparently, present in MacOS 12



If people let me know of more I can plug them into HFSleuth.

[AmirHamza]

Thank you for sharing it's great