HFSleuth - Unknown compression type: 3

Used for discussing the various tools in the book as well as encouraging members to share tools

HFSleuth - Unknown compression type: 3

Postby forestcorgi » Mon Sep 11, 2017 2:34 am

Your past self wishes to inform you of an unknown compression type while pulling files from a decrypted iOS root filesystem.
forestcorgi
 
Posts: 7
Joined: Wed Jul 05, 2017 5:44 pm

Re: HFSleuth - Unknown compression type: 3

Postby morpheus » Wed Sep 13, 2017 2:07 pm

Which IPSW was that? It's a quick fix.

(APFS support for HFSleuth coming soon, too :-)
morpheus
Site Admin
 
Posts: 697
Joined: Thu Apr 11, 2013 6:24 pm

Re: HFSleuth - Unknown compression type: 3

Postby matt » Tue Mar 20, 2018 11:58 am

Hi. Is there any documentation about the differences between the supported compression types? type1/3/4/12 etc

Are they different compression schemes altogether?

Thanks!
matt
 
Posts: 1
Joined: Tue Mar 20, 2018 10:56 am

Re: HFSleuth - Unknown compression type: 3

Postby morpheus » Wed Mar 21, 2018 11:06 pm

Yes, in the kernel's bsd/sys/decmpfs.h. Problem is the rest are in AppleFSCompression, which is closed source. The types I saw are

Code: Select all
  switch (CompressionType)
        {

                case 4:  // Older style, still present in iOS 9
                  ..
                case 8: // Newer, apparently, present in MacOS 12



If people let me know of more I can plug them into HFSleuth.
morpheus
Site Admin
 
Posts: 697
Joined: Thu Apr 11, 2013 6:24 pm

Re: HFSleuth - Unknown compression type: 3

Postby AmirHamza » Fri Apr 13, 2018 6:29 pm

Thank you for sharing it's great
AmirHamza
 
Posts: 1
Joined: Fri Apr 13, 2018 10:25 am


Return to Tools

Who is online

Users browsing this forum: No registered users and 6 guests