Page 1

APFS & APPLEFILESYSTEM · A GUIDE FOR UK LAWYERS APFS and the Apple File System Snapshots, Clones and Containers: Where Deleted Data Hides on Apple Devices COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM DELETED-DATA RECOVERY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a file system that keeps the past 03 How APFS works: containers, copy-on-write, clones 04 Snapshots: the treasure of prior states 05 Recovering deleted and earlier data 06 Timestamps, interpretation and honest limits 07 Deployment: prior versions, deletion and timelines 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: APFS, the file system on every modern Mac, iPhone and iPad, uses copy-on-write, snapshots and clones, so deleted and earlier versions of data survive more often, and in different places, than intuition suggests, and snapshots in particular can preserve whole prior states of the device.

§ 02 · FIRST PRINCIPLES The problem in plain English: a file system that keeps the past

§ 03 · HOWAPFSWORKS How APFS works: containers, copy-on-write, clones CONTAINER VOLUMES COPY-ON-WRITE CLONES SNAPSHOTS