Page 1
APFS & APPLEFILESYSTEM · A GUIDE FOR UK LAWYERS APFS and the Apple File System Snapshots, Clones and Containers: Where Deleted Data Hides on Apple Devices COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM DELETED-DATA RECOVERY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a file system that keeps the past 03 How APFS works: containers, copy-on-write, clones 04 Snapshots: the treasure of prior states 05 Recovering deleted and earlier data 06 Timestamps, interpretation and honest limits 07 Deployment: prior versions, deletion and timelines 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: APFS, the file system on every modern Mac, iPhone and iPad, uses copy-on-write, snapshots and clones, so deleted and earlier versions of data survive more often, and in different places, than intuition suggests, and snapshots in particular can preserve whole prior states of the device.
§ 02 · FIRST PRINCIPLES The problem in plain English: a file system that keeps the past
§ 03 · HOWAPFSWORKS How APFS works: containers, copy-on-write, clones CONTAINER VOLUMES COPY-ON-WRITE CLONES SNAPSHOTS
Page 2
§ 04 · SNAPSHOTS Snapshots: the treasure of prior states
§ 05 · RECOVERINGDELETEDANDEARLIERDATA Recovering deleted and earlier data
§ 06 · INTERPRETATIONANDHONESTLIMITS Timestamps, interpretation and honest limits
§ 07 · DEPLOYMENT Deployment: prior versions, deletion and timelines
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE LIVE APFS MACHINE / I CLOUD I PHONE / LOCAL DELETED / SNAPSHOTS RECOVERABLE TIME PAIRED BACKUPS IPAD
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDELETEDDOCUMENTASNAPSHOTKEPTWHOLE EXAMPLE2 · THEEARLIERVERSIONTHATEXPOSEDTHEEDIT EXAMPLE3 · THECLONETHATWASNOTTWODOCUMENTS
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANAPFSANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The APFS checklist Red flags When to involve a digital forensic expert 2 and 3,
§ 6). The findings are dated using snapshots as checkpoints, assessed in context, and corroborated
§ 13 · COMMON QUESTIONS Frequently asked questions If a file was deleted from an Apple device, is it recoverable? What is an APFS snapshot, and why does it matter? Can we prove a document was altered after it was signed? Why does it matter whether something is a clone? How urgent is preserving an Apple device for APFS recovery? Do APFS timestamps tell us exactly when things happened?
§ 14 · REFERENCE Glossary APFS Sources and authoritative references DISCLAIMER
Page 4
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, APFS And The Apple File System, Computer Forensics Lab, https://e-discovery.uk/library/apfs-and-the-apple-file-system/pdf.