APFS
Definition
Apple File System. Default on macOS since 10.13 High Sierra (2017). Container-and-volume design, copy-on-write, native snapshots, native encryption, space sharing across volumes inside a container.
- Full name
- Apple File System
- Default since
- macOS 10.13 High Sierra, 2017
- Design
- Container-and-volume, copy-on-write
- Features
- Native snapshots, native encryption, space sharing across volumes
Common questions
How does APFS's copy-on-write design affect forensic recovery of deleted files?+
Copy-on-write means an edited file's old data blocks are not overwritten in place but marked free once no snapshot references them, so recovery odds depend heavily on whether a relevant snapshot still exists rather than on classic unallocated-space carving alone.
Why can multiple APFS volumes on one disk complicate an imaging job?+
A single APFS container can host several volumes sharing the same underlying free space pool, so an examiner needs to account for the whole container rather than treating each volume as an isolated, independently sized partition the way older file systems worked.
Related terms
- Keychain
- Apple's encrypted credential store. The per-user database at ~/Library/Keychains/login.keychain-db holds passwords, Wi-Fi PSKs, private keys, certificates and secure notes. Decryption needs the...
- Launchd
- macOS process supervisor that boots and manages every system and user service. Replaces init/cron/SysV-RC. Configured via .plist files under /Library/LaunchDaemons, /Library/LaunchAgents, and...
- Property List (Plist)
- Apple's key-value config file format. Either XML or binary (bplist00 magic). Parsed with plutil, plistutil, or mac_apt. Holds preferences, recent items, login...
- Time Machine
- Apple's built-in backup system. On HFS+ targets it produced incremental hard-link trees in Backups.backupdb; on APFS targets (macOS 11 Big Sur and...
- Unified Logging
- macOS 10.12+ replacement for syslog. Binary .tracev3 files in /var/db/diagnostics/ and /var/db/uuidtext/. Queried with `log show --predicate ...`. Holds an order of...