Pkg.APFS — API for parsing APFS containers and volumes

Overview

The Pkg.APFS module contains the API for parsing Apple File System (APFS) containers and volumes.

APFS is Apple’s proprietary file system, used on macOS, iOS, watchOS, and tvOS since 2017. An APFS container holds one or more volumes that share the same underlying storage. APFS supports features such as copy-on-write, snapshots, clones, encryption, and transparent file compression.

Enumerating Volumes

The following code example demonstrates how to list the volumes in an APFS container:

from Pro.Core import *
from Pkg.APFS import *

def listVolumes(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    obj = APFSObject()
    if not obj.Load(c) or not obj.Initialize():
        return
    for i in range(obj.GetVolumeCount()):
        vi = obj.GetVolumeInfo(i)
        print("Volume %d: %s (%d files)" % (i, vi.name, vi.num_files))

Enumerating Files

The following code example demonstrates how to enumerate files in an APFS volume:

from Pro.Core import *
from Pkg.APFS import *

def enumerateFiles(fname):
    c = createContainerFromFile(fname)
    if c.isNull():
        return
    obj = APFSObject()
    if not obj.Load(c) or not obj.Initialize():
        return
    vol = obj.GetVolumeObject(0)
    if not vol:
        return
    nre = CFSNonRecursiveEnum(vol)
    nre.AddPath(vol.FSRootDirectory())
    while True:
        f = nre.Next(None)
        if not f:
            break
        entry = vol.FSGetEntry(f, None)
        if not entry.IsNull():
            print(entry.Name(), entry.DataSize())

Module API

Pkg.APFS module API.

Classes:

APFSObject()	This class represents an APFS container (the top-level structure).
APFSVolumeObject()	This class represents a single APFS volume.
VolumeInfo()	Contains information about an APFS volume within a container.

class APFSObject

Bases: Pro.Core.CFFObject

This class represents an APFS container (the top-level structure).

Use GetVolumeCount() and GetVolumeInfo() to enumerate the volumes within the container.

Methods:

GetVolumeCount()	Returns the number of volumes in the container.
GetVolumeInfo(i)	Returns information about the volume at the given index.
GetVolumeObject(i)	Returns a APFSVolumeObject for the volume at the given index.

GetVolumeCount() → int

Returns the number of volumes in the container.

Returns

The volume count.

Return type

int

GetVolumeInfo(i: int) → Optional[Pkg.APFS.VolumeInfo]

Returns information about the volume at the given index.

Parameters

i (int) – The zero-based volume index.

Returns

The volume information, or None if the index is invalid.

Return type

Optional[VolumeInfo]

See also GetVolumeCount().

GetVolumeObject(i: int) → Optional[Pkg.APFS.APFSVolumeObject]

Returns a APFSVolumeObject for the volume at the given index.

The returned object owns an independent reference-counted handle and can safely outlive this container object.

Parameters

i (int) – The zero-based volume index.

Returns

The volume object, or None if the index is invalid.

Return type

Optional[APFSVolumeObject]

See also GetVolumeInfo().

class APFSVolumeObject

Bases: Pro.Core.CFFObject

This class represents a single APFS volume.

The class provides file system support through the CFS interface inherited from CFFObject.

class VolumeInfo

Contains information about an APFS volume within a container.

Attributes:

index	The zero-based index of the volume within the container.
name	The volume name.
num_dirs	The number of directories in the volume.
num_files	The number of files in the volume.
num_symlinks	The number of symbolic links in the volume.

index: int

The zero-based index of the volume within the container.

name: str

The volume name.

num_dirs: int

The number of directories in the volume.

num_files: int

The number of files in the volume.

num_symlinks: int

The number of symbolic links in the volume.