Hansen K.H., Toolan F. Decoding the APFS file system

Boston: Elsevier, 2017. — 27 p.File systems have always played a vital role in digital forensics and during the past 30–40 years many of these have been developed to suit different needs. Some file systems are more tightly connected to a specific Operating System (OS). For instance HFS and HFS+ have been the file systems of choice in Apple devices for over 30 years.
Much has happened in the evolution of storage technologies, the capacity and speed of devices has increased and Solid State Drives (SSD) are replacing traditional drives. All of these present challenges for file systems. APFS is a file system developed from first principles and will, in 2017, become the new file system for Apple devices. To date there is no available technical information about APFS and this is the motivation for this article.Background
The APFS file system
Snapshots
APFS and digital forensic challenges
Tables in APFS
Table type 0
Table type 2
Table type 7
The bitmap structure
Bitmap Descriptor
Bitmap record block (BMRB)
Bitmap block (BMB)
Catalog B-Tree structure
Root node
Leaf Nodes
Extent blocks
Appendix B. File name records
Appendix C. Abbreviations used in the article