Crate apfs_forensic 

apfs-forensic — a graded anomaly auditor over apfs_core.

Mirrors ntfs-forensic: a typed AnomalyKind domain enum that keeps APFS knowledge, plus audit_* entry points that convert each anomaly into a forensicnomicon::report::Finding via forensicnomicon::report::Observation (static codes) so an APFS volume’s anomalies aggregate uniformly with the partition and container layers. Every finding is an observation (“consistent with …”), never a verdict — the examiner/tribunal concludes.

Anomaly findings that report something unrecognized (an unexpected keybag tag, a bad magic, an oid/xid) MUST carry the raw offending value + location in their evidence (fleet “show the unrecognized value” rule).

Coverage

Implements the P9 audits of docs/plans/2026-06-21-apfs-forensic-design.md: integrity (XID-REUSE), snapshots (name↔metadata + xid ordering), recovery (reaper-pending), encryption-state surfacing, broken-seal detection, and clone-finding logic, driven by audit_container / audit_volume. The fixture-dependent leads documented in the design — sealed-volume hash recomputation (needs a real SSV), extent-reference shared-block detection (needs the extentref reader + a clone corpus), and the broader superseded-checkpoint / orphan-inode recovery leads — are scoped to land with their validating corpora rather than guess.

Modules

clones

Clone / dedup analysis.

crypto

Encryption-state surfacing (no key cracking).

integrity

Structural integrity audits: Fletcher-64 checksum mismatches, object-map inconsistencies, checkpoint-ring malformation, and (oid, xid) reuse.

recovery

Deleted-record recovery leads from copy-on-write residue.

sealed

Sealed / signed-system-volume validation (the analyzer side).

snapshots

Snapshot audits: xid/create-time disorder, missing metadata vs name records, and snapshot-vs-live divergence.

timestamps

Timestamp anomaly leads (deliberately Info — FP-prone).

Structs

Finding

A normalized forensic finding — an observation, never an assertion of intent.

Source

The analyzer (and the scope within the medium) that produced a finding.

Enums

AnomalyKind

The APFS-specific anomalies this analyzer can surface. Each variant maps to a published, scheme-prefixed SCREAMING-KEBAB code (never changed once shipped; new variants get new codes).

Category

The forensic lens a finding belongs to — the analytical category, not a severity. Fine-grained threat taxonomy (C2, ransomware, injection) lives in the finding’s code and MITRE refs, not in new categories.

Severity

Severity of a forensic finding (Info < Low < Medium < High < Critical).

Functions

audit_container

Audit a whole container: open it, run the container-level integrity audit, then every volume (audit_volume) and the reaper recovery audit. Reads through reader (the same source the container was opened over), so the caller need not pre-open — pass the image reader and block size.

audit_volume

Audit a single volume: snapshot consistency (snapshots::audit) and clone relationships (clones::audit). Per-inode timestamp leads (timestamps::audit) and encryption/sealed audits are driven by callers that hold the relevant inode / state / integrity-metadata.

Type Aliases

Result

Audit result — errors are apfs_core read/parse failures surfaced loudly (never swallowed into an empty finding set).