Volume Grafting
Volume grafting is a mechanism introduced in macOS 13 that mounts a disk image’s APFS contents as a subdirectory of an existing volume. This is...
Read more : Volume GraftingDigital Forensic Researcher and Educator
Volume grafting is a mechanism introduced in macOS 13 that mounts a disk image’s APFS contents as a subdirectory of an existing volume. This is...
Read more : Volume GraftingA 27-part deep dive into the Apple File System covering on-disk structures, B-Trees, encryption, and more.
View the series : APFS InternalsIn our posts on Keybags, Wrapped Keys, and Decryption, we covered the static encryption architecture of APFS: how keys are...
In our post on Data Streams, we discussed how APFS implements file cloning through shared extents and reference counting. While...
APFS supports transparent file compression through the DECMPFS (Decompression File System) framework, shared with HFS+. Compressed files appear normal to...
In our post on Inode and Directory Records, we noted that a single inode may be referenced by more than...
APFS containers include an embedded EFI driver that allows UEFI firmware to boot from APFS partitions without requiring a built-in...
SpiceCrypt 3.0.0 is out. When I introduced SpiceCrypt in March, it decrypted PSpice and LTspice model files so engineers could...
In our post on Containers, we introduced the Reaper as the subsystem responsible for garbage collection in APFS. The Reaper...
In our earlier post on Containers, we introduced the Space Manager as the subsystem responsible for tracking which blocks are...
Back in 2022 I started the APFS Advent Challenge: a daily run of posts dissecting the on-disk internals of Apple’s...