A simple guide on how to mount APFS (MacOS) E01 images in Linux.

Instructions based on this tutorial.

First things first, install apfs-fuse. This tutorial is great for Ubuntu. After running the ‘make’ command, I copied the binaries to /usr/local/bin so they are always accessible:

sudo cp apfs-* /usr/local/bin/

Mounting #

Create mountpoint for E01 image #

mkdir /mnt/ewf

Mount the E01 image and verify the mountpoint #

sudo ewfmount /path/to/your/APFS.E01 /mnt/ewf
sudo ls -la /mnt/ewf 

Look at the partition table to identify the starting offset of the partition of interest #

sudo mmls /mnt/ewf/ewf1

The partition we want to mount starts at offset 409640.

Units are in 512-byte sectors so we multiply our offset of interest by 512. 409640*512 = 209735680.

Mount the ewf1 as a loop device: #

df -h

First, we need to identify which loop is free for us to mount on:

This is an output example I took from here, the user is on Ubuntu 20.04.

As you can see, the biggest “loop” is loop4. The user above would mount the partition to /dev/loop5, because all other /dev/loop (below 5) are being used.

sudo losetup -r -o (OffsetX512) /dev/loop(YourNumber) /mnt/ewf/ewf1

Create a mountpoint for your APFS Partition #

sudo mkdir /mnt/apfs

Mount the loop device with apfs-fuse and verify #

sudo apfs-fuse /dev/loop(YourNumber) /mnt/apfs
sudo ls -la /mnt/apfs

It should return root and private-dir directory. The user files are in the root directory.

Unmounting #

Unmount the APFS mountpoint #

sudo umount /mnt/apfs

Detach the loop device #

sudo losetup --detach /dev/loop(YourNumber)

Unmount the E01 image #

sudo umount /mnt/ewf