Practical Mobile Forensics
上QQ阅读APP看书,第一时间看更新

The APFS structure

So, APFS is structured in a single container that may contain one or more volumes. The APFS structure is presented in the following diagram:

Overview of the APFS structure

Each filesystem structure in APFS starts with a block header. The block header starts with a checksum (Fletcher's checksum algorithm is used) for the whole block and also contains the copy-on-write version of the block, the block ID, and the block type.

The APFS structure can be explained as follows:

  • The Container Superblock contains information on the block size, the number of blocks and pointers to the space manager for this task, the block IDs of all volumes, and a pointer to a block map B-Tree (which contains entries for each volume, along with its ID and offset).
  • Nodes are used for storing different kinds of entries. They can be part of a B-Tree or exist on their own and can contain either flexible or fixed-sized entries.
  • The Space Man(ager) manages the allocated blocks in the APFS container, and stores the number of free blocks and a pointer to the Allocation Info File.
  • The Allocation Info File stores the allocation file's length, version, and the offset.
  • The B-Trees manage multiple nodes and contain the offset of the root node.
  • A Volume Superblock contains the name of the volume, its ID, and a timestamp.

As for allocation files, they are simple bitmaps and do not have a block header and type ID.