Apple File System (APFS)

From ForensicsWiki
Jump to: navigation, search

APFS, or Apple File System, is the file system designed by Apple Computer to supersede HFS+ and take advantage of flash/SSD storage and native encryption support. APFS also introduced file system snapshots, support for sparse files, and greater time stamp granularity.

It was announced at the Apple Worldwide Developer Conference (WWDC) in 2016 and is meant to be used with watchOS, iOS, tvOS, and macOS. A Developer Preview version was first released with macOS Sierra 10.12. APFS became the default file system with the release of macOS High Sierra 10.13 released to the public on September 25, 2017.


Features

Max file size of 263 bytes was mantinted from HFS+ and new features include:

  • Snapshots (can be mounted read-only)
  • Atomic Safe-save (single transaction save)
  • File and directory clones (without using additional storage space)
  • Space-Sharing (volumes grow and shrink, sharing underlying free space)
  • Sparse file support (more efficient empty space representation)
  • Fast directory sizing (more efficient total space computation of a directory)



Feature

Mac OS Extended (HFS+)

Apple File System (APFS)

Number of allocation blocks (Maximum Number of Files)

232 (4 billion)

263 (9 quintillion)

File IDs (iNode numbering)

32-bit

64-bit

Time stamp granularity

1 second

1 nanosecond

Crash protection

Journaled

Copy-on-write

Full disk encryption

Yes (FileVault)

Yes (native)

Extended Attribute Support

Yes (retrofitted)

Yes (native)



External Links

Apple File System Guide - Introduction

Introducing Apple File System

Slides from filesystem talk at MacSysAdmin 2016 by Rich Trouton

Creating APFS volumes by Howard Oakley