Page 1 of 1

HFSleuth - Unknown compression type: 3

PostPosted: Mon Sep 11, 2017 2:34 am
by forestcorgi
Your past self wishes to inform you of an unknown compression type while pulling files from a decrypted iOS root filesystem.

Re: HFSleuth - Unknown compression type: 3

PostPosted: Wed Sep 13, 2017 2:07 pm
by morpheus
Which IPSW was that? It's a quick fix.

(APFS support for HFSleuth coming soon, too :-)

Re: HFSleuth - Unknown compression type: 3

PostPosted: Tue Mar 20, 2018 11:58 am
by matt
Hi. Is there any documentation about the differences between the supported compression types? type1/3/4/12 etc

Are they different compression schemes altogether?

Thanks!

Re: HFSleuth - Unknown compression type: 3

PostPosted: Wed Mar 21, 2018 11:06 pm
by morpheus
Yes, in the kernel's bsd/sys/decmpfs.h. Problem is the rest are in AppleFSCompression, which is closed source. The types I saw are

Code: Select all
  switch (CompressionType)
        {

                case 4:  // Older style, still present in iOS 9
                  ..
                case 8: // Newer, apparently, present in MacOS 12



If people let me know of more I can plug them into HFSleuth.

Re: HFSleuth - Unknown compression type: 3

PostPosted: Fri Apr 13, 2018 6:29 pm
by AmirHamza
Thank you for sharing it's great