Practical Mobile Forensics(Third Edition)
上QQ阅读APP看书,第一时间看更新

The APFS structure

So, APFS is structured in a single container, which may contain one or more volumes. The APFS structure is presented in the following figure:

APFS structure overview (https://blog.cugu.eu/post/apfs/)

Each filesystem structure in APFS starts with a block header. The block header starts with a checksum (Fletcher's checksum algorithm is used) for the whole block, and also contains the copy-on-write version of the block, the block ID, and the block type.

The container superblock contains information on the block size, the number of blocks, and pointers to the space manager for this task, the block IDs of all volumes, and a pointer to a block map B-tree (contains entries for each volume with its ID and offset).

Nodes are used for storing different kinds of entries. They can be part of a B-tree or exist on their own, and can either contain flexible or fixed-sized entries.

The space manager manages allocated blocks in the APFS container, and stores the number of free blocks and a pointer to the allocation info file.

The allocation info file stores the allocation file's length, version and the offset.

B-trees manage multiple nodes, and contain the offset of the root node.

volume superblock contains the name of the volume, an ID and a timestamp.

As for allocation files, they are simple bitmaps, and do not have a block header and type ID.