Difference between revisions of "Apple File System (APFS)"

From ForensicsWiki
Jump to: navigation, search
m (High Sierra release info)
Line 96: Line 96:
  
 
== External Links ==
 
== External Links ==
[https://developer.apple.com/library/content/documentation/FileManagement/Conceptual/APFS_Guide/Introduction/Introduction.html Apple File System Guide - Introduction]
 
  
[http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietcautcrv/701/701_introducing_apple_file_system.pdf Introducing Apple File System]
+
* [https://developer.apple.com/library/content/documentation/FileManagement/Conceptual/APFS_Guide/Introduction/Introduction.html Apple File System Guide - Introduction]
 +
* [http://devstreaming.apple.com/videos/wwdc/2016/701q0pnn0ietcautcrv/701/701_introducing_apple_file_system.pdf Introducing Apple File System]
 +
* [https://derflounder.wordpress.com/2016/10/05/slides-from-the-whats-new-in-file-system-session-at-macsysadmin-2016/ Slides from filesystem talk at MacSysAdmin 2016 by Rich Trouton]
 +
* [https://eclecticlight.co/2017/04/08/how-to-make-your-own-apfs-volume/ Creating APFS volumes by Howard Oakley]
  
[https://derflounder.wordpress.com/2016/10/05/slides-from-the-whats-new-in-file-system-session-at-macsysadmin-2016/ Slides from filesystem talk at MacSysAdmin 2016 by Rich Trouton]
+
=== Format details ===
  
[https://eclecticlight.co/2017/04/08/how-to-make-your-own-apfs-volume/ Creating APFS volumes by Howard Oakley]
+
* [https://www.researchgate.net/publication/319573636_Decoding_the_APFS_file_system Decoding the APFS file system], by Hansen, Kurt & Toolan, Fergus, September 22, 2017
 +
* [https://blog.cugu.eu/files/pub/2018_04_ernw_whitepaper_apfs.pdf ERNW WHITEPAPER 65 - APFS INTERNALS FOR FORENSIC ANALYSIS], by Andreas Dewald, Jonas Plum, April 16, 2018

Revision as of 07:27, 15 September 2018

APFS, or Apple File System, is the file system designed by Apple Computer to supersede HFS+ and take advantage of flash/SSD storage and native encryption support. APFS also introduced file system snapshots, support for sparse files, and greater time stamp granularity.

It was announced at the Apple Worldwide Developer Conference (WWDC) in 2016 and is meant to be used with watchOS, iOS, tvOS, and macOS. A Developer Preview version was first released with macOS Sierra 10.12. APFS became the default file system with the release of macOS High Sierra 10.13 released to the public on September 25, 2017.


Features

Max file size of 263 bytes was mantinted from HFS+ and new features include:

  • Snapshots (can be mounted read-only)
  • Atomic Safe-save (single transaction save)
  • File and directory clones (without using additional storage space)
  • Space-Sharing (volumes grow and shrink, sharing underlying free space)
  • Sparse file support (more efficient empty space representation)
  • Fast directory sizing (more efficient total space computation of a directory)



Feature

Mac OS Extended (HFS+)

Apple File System (APFS)

Number of allocation blocks (Maximum Number of Files)

232 (4 billion)

263 (9 quintillion)

File IDs (iNode numbering)

32-bit

64-bit

Time stamp granularity

1 second

1 nanosecond

Crash protection

Journaled

Copy-on-write

Full disk encryption

Yes (FileVault)

Yes (native)

Extended Attribute Support

Yes (retrofitted)

Yes (native)



External Links

Format details