Apple File System (APFS)
| Format | Apple File System (APFS) |
|---|---|
| Short name | APFS |
| Category | filesystem |
| Platforms | macOS, iOS |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Apple's copy-on-write filesystem on iOS 10.3+ and macOS 10.13+. A container holds several volumes sharing one space pool; metadata is kept in B-trees addressed through an object map, and every change is written to new blocks under a new transaction ID. Older checkpoints and superseded tree nodes can therefore remain on disk. Volumes may be encrypted per volume or per file (Data Protection on iOS) and can carry snapshots. Timestamps are nanoseconds since 1970 UTC.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 32 (0x20) | 4E 58 53 42 | NXSB | Container superblock magic 'NXSB' (block 0) |
Known extensions
None recorded
References
- Apple File System Reference (Apple, 2020-06-22) https://developer.apple.com/support/downloads/Apple-File-System-Reference.pdf
- Apple File System (APFS) — format documentation (libyal/libfsapfs) https://github.com/libyal/libfsapfs/blob/main/documentation/Apple%20File%20System%20(APFS).asciidoc
- Mobile Forensics – The File Format Handbook: APFS (Rune Nordvik, Springer, 2022) https://doi.org/10.1007/978-3-030-98467-0_1
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “Apple File System (APFS)”. https://kalink0.github.io/crush-forensics/formats/apfs/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction