#apfs

A pure Go, cross-platform APFS and HFS+ toolkit: read, mount and write disk images without macOS. Reads DMGs and raw images, unlocks FileVault volumes, and writes populated volumes, snapshots, volume groups and transparent compression. Validated against Apple's fsck_apfs, hdiutil and Linux apfsck.

Read-only forensic VFS contracts composing evidence into one positioned-read byte edge — ArchiveOpen · ContainerOpen · VolumeSystemOpen · EncryptionOpen · FileSystemOpen — with recursive PathSpec locators. The contract crate every fleet reader implements.