Practical Mobile Forensics - Fourth Edition

The HFS Plus and APFS filesystems

To better understand the forensic process of an iOS device, it is useful to know about the filesystem that is used. Originally, the filesystem used in the iPhone and other Apple iOS devices was HFSX. This is a variation of HFS Plus, with one major difference. HFSX is case-sensitive, whereas HFS Plus is case-insensitive. Other differences will be discussed later in this chapter. APFS was introduced in June 2016 as a replacement for HFS Plus and became the default filesystem for iOS devices with the release of iOS 10.3, and for macOS devices with the release of macOS 10.13.