Speculative Telemetry
Speculative telemetry is an APFS feature that tracks the lifecycle of speculatively downloaded files: content fetched to local storage before the user explicitly requests it,...
Read more : Speculative TelemetryDigital Forensic Researcher and Educator
Speculative telemetry is an APFS feature that tracks the lifecycle of speculatively downloaded files: content fetched to local storage before the user explicitly requests it,...
Read more : Speculative TelemetryA 27-part deep dive into the Apple File System covering on-disk structures, B-Trees, encryption, and more.
View the series : APFS InternalsVolume grafting is a mechanism introduced in macOS 13 that mounts a disk image’s APFS contents as a subdirectory of...
In our posts on Keybags, Wrapped Keys, and Decryption, we covered the static encryption architecture of APFS: how keys are...
In our post on Data Streams, we discussed how APFS implements file cloning through shared extents and reference counting. While...
APFS supports transparent file compression through the DECMPFS (Decompression File System) framework, shared with HFS+. Compressed files appear normal to...
In our post on Inode and Directory Records, we noted that a single inode may be referenced by more than...
APFS containers include an embedded EFI driver that allows UEFI firmware to boot from APFS partitions without requiring a built-in...
SpiceCrypt 3.0.0 is out. When I introduced SpiceCrypt in March, it decrypted PSpice and LTspice model files so engineers could...
In our post on Containers, we introduced the Reaper as the subsystem responsible for garbage collection in APFS. The Reaper...
In our earlier post on Containers, we introduced the Space Manager as the subsystem responsible for tracking which blocks are...