Photo of Joe T. Sylve

Joe T. Sylve, Ph.D.

Digital Forensic Researcher and Educator

Joe T. Sylve, Ph.D. – Blog

Series

APFS Internals

An 18-part deep dive into the Apple File System covering on-disk structures, B-Trees, encryption, and more.

View the series : APFS Internals

Posts (Page 1 of 3)

Fusion Containers

As we discussed in an earlier post, Apple’s Fusion Drives combine the storage capacity of a hard disk drive (HDD)...

APFS Internals · Part 18

Snapshot Metadata

Our previous post covered how Object Maps facilitate the implementation of point-in-time Snapshots of APFS file systems by preserving File...

APFS Internals · Part 17

Decryption

Now that we know how to parse the File System Tree, analyze keybags, and unwrap decryption keys, it’s time to...

APFS Internals · Part 16

Update: Blazingly Fast-er SIMD Checksums

This is a quick update to yesterday’s post on using std::experimental::simd to speed up APFS Fletcher-64 calculations. It turns out...

High performance computing

Blazingly Fast Checksums with SIMD

Today’s post will take on a bit of a different style than the previous posts in this series. Among other...

File systems

Wrapped Keys

In our last post, we discussed both Volume and Container Keybags and how they protect wrapped Volume Encryption and Key...

APFS Internals · Part 15

Keybags

APFS is designed with encryption in mind and removes the need for the Core Storage layer used to provide encryption...

APFS Internals · Part 14

Sealed Volumes

With the release of macOS 11, Apple added a security feature to APFS called sealed volumes. Sealed volumes can be...

APFS Internals · Part 13