Ebook: Decoding the APFS file system

Liberated from https://www.researchgate.net/publication/319573636; retrieved from https://github.com/darlinghq/darling-dmg/files/1741393/DIIN_698_Revisedproof.pdf on December 26th, 2018.

Abstract:

File systems have always played a vital role in digital forensics and during the past 30–40 years many of
these have been developed to suit different needs. Some file systems are more tightly connected to a
specific Operating System (OS). For instance HFS and HFS+ have been the file systems of choice in Apple
devices for over 30 years.
Much has happened in the evolution of storage technologies, the capacity and speed of devices has
increased and Solid State Drives (SSD) are replacing traditional drives. All of these present challenges for
file systems. APFS is a file system developed from first principles and will, in 2017, become the new file
system for Apple devices.
To date there is no available technical information about APFS and this is the motivation for this article.