has moved to this site, For information, please join the Google Group forensicswiki-reborn

Apple File System (APFS)

From Forensics Wiki
Jump to navigation Jump to search

APFS, or Apple File System, is the file system designed by Apple Computer to supersede HFS+ and take advantage of flash/SSD storage and native encryption support. APFS also introduced file system snapshots, support for sparse files, and greater time stamp granularity.

It was announced at the Apple Worldwide Developer Conference (WWDC) in 2016 and is meant to be used with watchOS, iOS, tvOS, and macOS. A Developer Preview version was first released with macOS Sierra 10.12. APFS became the default file system with the release of macOS High Sierra 10.13 released to the public on September 25, 2017.


Max file size of 263 bytes was mantinted from HFS+ and new features include:

  • Snapshots (can be mounted read-only)
  • Atomic Safe-save (single transaction save)
  • File and directory clones (without using additional storage space)
  • Space-Sharing (volumes grow and shrink, sharing underlying free space)
  • Sparse file support (more efficient empty space representation)
  • Fast directory sizing (more efficient total space computation of a directory)


Mac OS Extended (HFS+)

Apple File System (APFS)

Number of allocation blocks (Maximum Number of Files)

232 (4 billion)

263 (9 quintillion)

File IDs (iNode numbering)



Time stamp granularity

1 second

1 nanosecond

Crash protection



Full disk encryption

Yes (FileVault)

Yes (native)

Extended Attribute Support

Yes (retrofitted)

Yes (native)

External Links

Apple File System Guide - Introduction

Introducing Apple File System

Slides from filesystem talk at MacSysAdmin 2016 by Rich Trouton

Creating APFS volumes by Howard Oakley