$ show libyal/libfsrefs
libfsrefs is a C library for reading and parsing the Microsoft Resilient File System (ReFS). It provides a forensic-oriented API to access volume headers, checkpoints, metadata blocks, file entries, and directory structures. The library is read-only and currently supports ReFS version 1 (experimental). It includes a command-line tool `fsrefsinfo` that outputs volume details and can generate bodyfile-format timelines for digital forensics. The architecture follows the libyal ecosystem pattern: layered parsing with abstractions for file I/O (libbfio), error handling (libcerror), and string encoding (libuna). The codebase is well-structured with extensive unit tests, OSS-Fuzz integration, and cross-platform build support via autotools and MSVC. While the library is not intended as a standalone application, it is a robust foundation for forensic tools that need to analyze ReFS volumes.
The LLM identified 2 files worth highlighting for reuse:
Provides inline macros for reading and writing integer values in big/little-endian byte order from/to byte streams. Supports 16, 24, 32, 48, and 64-bit sizes. This is a generic, zero-dependency C header that can be extracted and reused in any project that needs to parse binary protocols or file formats with explicit endianness.
Implements parsing of ReFS data runs (extent lists that map logical clusters to physical offsets). The module initializes, frees, and reads data run entries from a buffer. It demonstrates a clean pattern for parsing variable-length, self-describing extent lists common in NTFS-derived filesystems. The interface is isolated via an opaque struct and can be adapted for other filesystems with similar extent mapping needs.