Practical Mobile Forensics - Fourth Edition

The APFS filesystem

APFS is a new filesystem for iOS, macOS, tvOS, and watchOS. It is a 64-bit filesystem and supports over 9 quintillion files on a single volume. The following is a list of its main features:

• Clones: These are instantaneous copies of files or directories. Modifications are written elsewhere and continue to share the unmodified blocks; the changes are saved as deltas of the cloned file.
• Snapshots: Point-in-Time (PIT) read-only instances of the filesystem.
• Space sharing: This allows multiple filesystems to share the same underlying free space on a physical volume.
• Encryption: There are three modes, as follows:
  • No encryption
  • Single-key encryption
  • Multi-key encryption with per-file keys for file data and a separate key for ...