MOBILE FORENSICS

APFS – Apple’s file system

The Apple File System (APFS) is Apple’s modern file system and forms the basis of current iPhones, iPads and Macs. It was developed for flash storage and offers features such as encryption, snapshots and copy-on-write. These characteristics have a direct impact on the possibilities and limitations of an IT forensic investigation.

Containers and Volumes
Copy-on-Write to prevent direct overwriting
Snapshots for consistent points in time
Multi-level encryption
Integrity mechanisms
Optimisation for SSD and flash storage

TECHNICAL BACKGROUND

Technical Fundamentals

APFS consists of containers, each of which contains one or more volumes. These volumes share the available storage dynamically.

Forensic characteristics:

  • •Containers and Volumes
  • •Copy-on-Write to prevent direct overwriting
  • •Snapshots for consistent points in time
  • •Multi-level encryption
  • •Integrity mechanisms
  • •Optimisation for SSD and flash storage

This architecture differs significantly from older file systems such as HFS+.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
As part of an iPhone or macOS forensic investigation, APFS structures are analysed depending on the available data backup. In addition to automated tools, a manual assessment of relevant file system artefacts is carried out. The results are documented in a reproducible manner and classified from a technical perspective.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What is an APFS container?
  • ✔What is the significance of volumes?
  • ✔How do snapshots work?
  • ✔What role does copy-on-write play?
  • ✔What impact does encryption have on the analysis?

LIMITATIONS & CONCLUSION

What you should know

Not all APFS volumes are available in every backup. The device model, operating system version, encryption and backup method determine the scope of the data that can be analysed.

APFS is a powerful file system with numerous security and integrity features. In the field of IT forensics, a thorough understanding of this architecture is essential for a robust analysis of digital evidence.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Do you need a professional analysis of an Apple file system or an iPhone backup? LanCologne can assist you with an objective IT forensic investigation and comprehensive documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

What is APFS?
The Apple File System is Apple’s current file system.
What are snapshots?
They represent the state of a file system at a specific point in time.
What does ‘copy-on-write’ mean?
Modified data is saved in a new location before existing data is overwritten.
Is APFS encrypted?
APFS supports modern encryption mechanisms, the use of which depends on the device and the configuration.
Can APFS be examined forensically?
Yes, provided that the necessary data and technical requirements are in place.