Photo of Joe T. Sylve

Joe T. Sylve, Ph.D.

Digital Forensic Researcher and Educator

Joe T. Sylve, Ph.D. – Blog

Posts (Page 3 of 4)

Update: Blazingly Fast-er SIMD Checksums

This is a quick update to yesterday’s post on using std::experimental::simd to speed up APFS Fletcher-64 calculations. It turns out...

High performance computing

Blazingly Fast Checksums with SIMD

Today’s post will take on a bit of a different style than the previous posts in this series. Among other...

File systems

Wrapped Keys

In our last post, we discussed both Volume and Container Keybags and how they protect wrapped Volume Encryption and Key...

APFS Internals · Part 21

Keybags

APFS is designed with encryption in mind and removes the need for the Core Storage layer used to provide encryption...

APFS Internals · Part 20

Sealed Volumes

With the release of macOS 11, Apple added a security feature to APFS called sealed volumes. Sealed volumes can be...

APFS Internals · Part 19

Data Streams

Data in APFS that is too large to store within records is stored elsewhere on disk and referenced by data...

APFS Internals · Part 16

Inode and Directory Records

Each APFS file system entry has both an inode and directory record. The inode record stores metadata such as the...

APFS Internals · Part 14

File System Trees

Each APFS volume has a logical file system stored on disk as a collection of File System Objects. Unlike other...

APFS Internals · Part 13

Volume Superblock Objects

The Volume Superblock is a data structure containing key information about an individual APFS volume. This post covers locating the...

APFS Internals · Part 12

Object Maps

Earlier in this series, we discussed APFS Containers and how they address physical objects via a fixed block size. This...

APFS Internals · Part 8