Photo of Joe T. Sylve

Joe T. Sylve, Ph.D.

Digital Forensic Researcher and Educator

APFS Internals

A deep dive into the Apple File System, published as part of the 2022 APFS Advent Challenge. 18 parts covering on-disk structures, B-Trees, encryption, and more.

Foundations

  1. Anatomy of an ObjectAPFS is a copy-on-write file system, consisting of a set of immutable objects that are...
  2. Kinds of ObjectsAs we discussed in our last post, objects are the fundamental building blocks of APFS....

Container Layer

  1. ContainersAPFS is a pooled storage, transactional, copy-on-write file system. Its design relies on a core...
  2. NX Superblock ObjectsThe NX Superblock Object is a key component of APFS. It stores key information about...
  3. Checkpoint Maps and Ephemeral ObjectsIn our last post, we discussed NX Superblock Objects and how they can be used...

B-Trees and Indexing

  1. B-Trees (Part 1)In yesterday’s post, we discussed Checkpoint Maps, the simple linear-time data structures that APFS uses...
  2. B-Trees (Part 2)Mastering the skill of B-Tree traversal is essential in parsing information from APFS. Our last...
  3. Object MapsEarlier in this series, we discussed APFS Containers and how they address physical objects via...

Volume Layer

  1. Volume Superblock ObjectsThe Volume Superblock is a data structure containing key information about an individual APFS volume....
  2. File System TreesEach APFS volume has a logical file system stored on disk as a collection of...
  3. Inode and Directory RecordsEach APFS file system entry has both an inode and directory record. The inode record...
  4. Data StreamsData in APFS that is too large to store within records is stored elsewhere on...

Integrity and Encryption

  1. Sealed VolumesWith the release of macOS 11, Apple added a security feature to APFS called sealed...
  2. KeybagsAPFS is designed with encryption in mind and removes the need for the Core Storage...
  3. Wrapped KeysIn our last post, we discussed both Volume and Container Keybags and how they protect...
  4. DecryptionNow that we know how to parse the File System Tree, analyze keybags, and unwrap...

Advanced Topics

  1. Snapshot MetadataOur previous post covered how Object Maps facilitate the implementation of point-in-time Snapshots of APFS...
  2. Fusion ContainersAs we discussed in an earlier post, Apple’s Fusion Drives combine the storage capacity of...