Text
Mobile Forensics – The File Format Handbook
The Apple File System (APFS) has been the standard FS for Apple devices
since 2017. At that time, no digital forensic tools supported it, leaving tool dependent
digital or mobile forensic investigators without the ability to investigate this file
system properly. The APFS was first enabled on iOS, the operating system of iPhone,
and later that same year on MacOS. APFS replaced the HFS+ FS. This chapter will
document the important metadata structures of APFS, which is based on state of the
art research, and we are focusing on the investigative meaning of the structures.
No other version available