Practical Mobile Forensics - Fourth Edition

The APFS structure

So, APFS is structured in a single container that may contain one or more volumes. The APFS structure is presented in the following diagram:

Overview of the APFS structure

Each filesystem structure in APFS starts with a block header. The block header starts with a checksum (Fletcher's checksum algorithm is used) for the whole block and also contains the copy-on-write version of the block, the block ID, and the block type.

The APFS structure can be explained as follows:

• The Container Superblock contains information on the block size, the number of blocks and pointers to the space manager for this task, the block IDs of all ...