APFS And The Apple File System

APFS & APPLEFILESYSTEM · AGUIDEFORUKLAWYERS APFS and the Apple File System Snapshots, Clones and Containers: Where Deleted Data Hides on Apple Devices COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM DELETED-DATA RECOVERY CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a file system that keeps the past 03 How APFS works: containers, copy-on-write, clones 04 Snapshots: the treasure of prior states 05 Recovering deleted and earlier data 06 Timestamps, interpretation and honest limits 07 Deployment: prior versions, deletion and timelines 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary The headline point: APFS, the file system on every modern Mac, iPhone and iPad, uses copy-on-write, snapshots and clones, so deleted and earlier versions of data survive more often, and in different places, than intuition suggests, and snapshots in particular can preserve whole prior states of the device. § 0 2 · FIRSTPRINCIPLES The problem in plain English: a file system that keeps the past § 0 3 · HOWAPFSWORKS How APFS works: containers, copy-on-write, clones CONTAINER VOLUMES COPY-ON-WRITE CLONES SNAPSHOTS § 0 4 · SNAPSHOTS Snapshots: the treasure of prior states § 0 5 · RECOVERINGDELETEDANDEARLIERDATA Recovering deleted and earlier data § 0 6 · INTERPRETATIONANDHONESTLIMITS Timestamps, interpretation and honest limits § 0 7 · DEPLOYMENT Deployment: prior versions, deletion and timelines § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE LIVE APFS MACHINE / ICLOUD IPHONE / LOCAL DELETED / SNAPSHOTS RECOVERABLE TIME PAIRED BACKUPS IPAD § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEDELETEDDOCUMENTASNAPSHOTKEPTWHOLE EXAMPLE2 · THEEARLIERVERSIONTHATEXPOSEDTHEEDIT EXAMPLE3 · THECLONETHATWASNOTTWODOCUMENTS § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORANAPFSANA LY SIS § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The APFS checklist Red flags When to involve a digital forensic expert 2 and 3, §6). The findings are dated using snapshots as checkpoints, assessed in context, and corroborated § 1 3 · COMMONQUESTIONS Frequently asked questions If a file was deleted from an Apple device, is it recoverable? What is an APFS snapshot, and why does it matter? Can we prove a document was altered after it was signed? Why does it matter whether something is a clone? How urgent is preserving an Apple device for APFS recovery? Do APFS timestamps tell us exactly when things happened? § 1 4 · REFERENCE Glossary APFS Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY