AFC (Apple File Conduit)
Definition
The iOS service that exposes the media partition for file transfer during synchronisation. In standard form it only surfaces the media partition; on jailbroken devices, AFC2 exposes the full file system, enabling file-system acquisition.
- Standard access
- Media partition only
- Jailbroken extension
- AFC2
- AFC2 effect
- Exposes the full file system
- Forensic use
- File-system acquisition pathway
Common questions
Why does AFC alone give an examiner limited value on a non-jailbroken device?+
Standard AFC surfaces only photos, media and a narrow set of app sandboxes, so it cannot reach system files, keychain data, or most app databases that a fuller acquisition would need.
What is the forensic significance of AFC2 versus AFC?+
AFC2 removes the media-partition restriction, giving read access to the root file system, which is why jailbreaking a seized device was historically used to enable deeper file-system extraction before newer acquisition tools closed that gap.
Related terms
- Android Debug Bridge (ADB)
- A command-line tool included in the Android SDK that allows communication with an Android device over USB or Wi-Fi. Used for logical...
- File-System Extraction
- A deeper form of extraction that retrieves the full accessible directory tree by mounting the file system or using a privileged API...
- iTunes Backup Protocol
- Apple's proprietary protocol for transferring device data to a computer. Used by forensic tools to conduct logical acquisition of iOS devices; backup...
- Logical Acquisition
- An extraction method that uses the device's own operating system interfaces, such as iTunes backup or Android Debug Bridge, to export the...
- Trust Relationship (iOS)
- The pairing between an iOS device and a computer established when the user taps 'Trust' after connecting. A forensic logical or file-system...