APFS Internals

Presented at Objective by the Sea version 1.0 (2018), Nov. 3, 2018, 1:50 p.m. (50 minutes).

APFS has become the de facto file system for MacOS and iOS as for 10.13/10.3- but what do we really know about it? Apple has promised the spec would be released "later this year" ... over two years ago!

Reversing the complex filesystem structures, container blocks, snapshots and trees is a lousy job, but someone had to do it. Jonathan will present the unofficial APFS specification as it appears in Volume II of the "*OS Internals" trilogy, and present a free tool for inspecting and traversing APFS partitions and disk images for MacOS, iOS - and Linux.

Presenters:

• Jonathan Levin - Founder of Technologeeks / Author of *OS Internals series.
  Jonathan Levin is a trainer and consultant specializing in operating system internals. He is the author of definitive books on Android Internals as well as "*OS Internals" series, and provides plentiful tools and research for the community on the books' web sites. He is founder and CTO of Technologeeks.com, a group of like-minded expert trainers and consultants.

Links:

• https://objectivebythesea.org/v1/talks.html#levin
• https://objectivebythesea.org/v1/talks/OBTS_v1_Levin.pdf

Similar Presentations:

• Black Hat Europe 2018 / The Last Line of Defense: Understanding and Attacking Apple File System on iOS
• Objective by the Sea version 4.0 (2021) / n-1 and n-2: Should we really trust in you?
• Objective by the Sea version 3.0 (2020) / Exploring MacOS with APOLLO