As we discussed in our last post, objects are the fundamental building blocks of APFS. While there are many different object types, each individual object can be one of three kinds: physical, virtual, or ephemeral. While each of these objects can be found on disk, there are differences in their lifetimes as well as the techniques needed to locate them.

APFS is a copy-on-write file system, consisting of a set of immutable objects that are the fundamental building blocks of the file system’s design. APFS objects are made up of one or more fixed-size blocks. Block sizes are configurable at the time of formatting a new container. Valid block sizes are any power-of-two sized value between 4 KiB and 64 KiB of data, and must always be an integer multiple of the block size of the underlying storage device. At the time of this writing, the default (and thus most common) block size is 4 KiB.

As an exercise in self-discipline, I’ve decided to get an early start on my 2023 New Year’s resolution of writing more and sharing what research I can with the community. As a sort of Digital Forensics Advent Calendar, I’m going to attempt to publish a daily series of informative blog posts detailing internals of Apple’s APFS file system.