Practical Mobile Forensics(Third Edition)
上QQ阅读APP看书,第一时间看更新

The APFS filesystem

APFS is a new filesystem for iOS, macOS, tvOS, and watchOS. It is a 64-bit filesystem and supports over 9 quintillion files on a single volume. Here is the list of its main features:

  • Clones: Instantaneous copies of files or directories. Modifications are written elsewhere and continue to share the unmodified blocks; changes are saved as deltas of the cloned file.
  • Snapshots: Points-in-time, read-only instances of the filesystem.
  • Space sharing: Allows multiple filesystems to share the same underlying free space on a physical volume.
  • Encryption: There are three modes:
    • No encryption
    • Single-key encryption
    • Multi-key encryption with per-file keys for file data and a separate key for sensitive metadata

Depending on the hardware, AES-XTS or AES-CBC encryption mode is used.

  • Crash protection: A novel copy-on-write metadata scheme, it's used to ensure that  filesystem updates are crash-protected.
  • Sparse files: Allow the logical size of files to be greater than the physical space they occupy on disk.
  • Fast directory sizing: Quickly computes the total space used by a directory hierarchy, allowing it to be updated as the hierarchy evolves.