APFS (Apple File System)
Definition
The default file system on iOS devices since iOS 10.3. Features include 64-bit inode numbers, copy-on-write metadata, file-level encryption using per-file keys, and snapshot support. The encryption model ties file keys to the device hardware UID, making physical NAND reads useless without the passcode-derived key hierarchy.
- Full name
- Apple File System
- Default since
- iOS 10.3
- Inode addressing
- 64-bit
- Encryption
- Per-file keys tied to device hardware UID
Common questions
Why does a raw NAND read of an iOS device usually fail to yield usable data?+
Each file's encryption key is derived through a hierarchy anchored in the device's hardware UID, a value that cannot be extracted from the chip and never leaves the secure enclave, so ciphertext pulled directly from NAND stays unreadable without the passcode-derived keys.
How does file-level encryption differ from full-disk encryption for forensic purposes?+
Full-disk encryption protects the whole volume with one key that, once unlocked, exposes everything, while APFS's per-file keys mean different files can require different protection classes, so some data such as certain notifications may remain accessible even while the device is locked, depending on its assigned class.
Related terms
- App Sandbox (iOS)
- The iOS isolation mechanism combining UNIX file permissions, signed entitlements, and TrustedBSD mandatory access control. Each app is confined to a container...
- Data Protection Classes (iOS)
- iOS encrypts each file under one of four protection classes that control when the file's encryption key is available: Complete (key available...
- Ext4
- The fourth extended file system, the default Linux file system used for the userdata partition on most Android devices before widespread F2FS...
- F2FS (Flash-Friendly File System)
- A log-structured file system designed for NAND flash, used on the userdata partition of many modern Android devices including Samsung Galaxy and...
- UID-Based Sandbox (Android)
- Android's application isolation model in which each installed app receives a unique Linux user ID at install time. The app's private data...