Fact-checked by Grok 2 weeks ago

Apple File System

The Apple File System (APFS) is a proprietary file system developed by Apple Inc. for its operating systems, including macOS, iOS, iPadOS, tvOS, watchOS, and visionOS. Introduced in 2017, APFS became the default file system replacing the Hierarchical File System Plus (HFS+), starting with macOS High Sierra (version 10.13) and iOS 10.3. Optimized for flash and solid-state drive (SSD) storage, it emphasizes performance, security, and efficiency through features like strong cryptographic encryption, copy-on-write metadata, space sharing across volumes, file and directory cloning, and snapshots for point-in-time data preservation. APFS integrates encryption directly into its core design, enabling secure data protection across Apple's devices such as , , , Apple TV, , and , without relying solely on separate tools like . It uses a container-based structure where multiple volumes share disk space dynamically, allocating it on demand to optimize storage utilization on SSDs. Compared to HFS+, APFS offers faster file operations, atomic safe-save mechanisms to prevent during writes, and improved resilience via snapshots that enable efficient backups and system recovery. These capabilities make APFS particularly suited for modern Apple hardware, supporting both bootable and data volumes while maintaining compatibility with encrypted and non-encrypted configurations.

History

Development and Introduction

The Apple File System (APFS) was developed as a successor to the Hierarchical File System Plus (HFS+), which had been in use since 1998 but exhibited significant limitations in the era of solid-state drives (SSDs) and modern storage demands. HFS+ was originally designed over 30 years ago for floppy disks and hard disk drives (HDDs), featuring single-threaded operations and rigid data structures that led to suboptimal performance on SSDs, including poor optimization for flash storage and a lack of native support for features like snapshots. These shortcomings, such as vulnerability to during interrupted writes and inefficiency with large-scale files in gigabytes, prompted Apple to initiate APFS development around 2014 to better support its ecosystem ranging from the to the . The project was led by key engineers at Apple, including Dominic Giampaolo, a senior software engineer in storage and file systems who served as the lead architect, and Eric Tamura, manager of local file systems. Giampaolo, previously known for his work on the Be File System, brought expertise in modern file system design to the effort. APFS was publicly announced at Apple's (WWDC) in June 2016, where it was presented as a from-scratch implementation optimized for SSDs and engineered with security in mind. APFS was introduced as the default in (version 10.13), released on September 25, 2017, initially supporting SSD-based systems for both bootable and data volumes. At launch, Apple highlighted key initial features including strong with multiple key options (per volume, per file, or per extent), native snapshots for point-in-time backups and system rollbacks, instant cloning of files and directories without full duplication, and space sharing to efficiently allocate storage across multiple volumes within a single container. Support for HDDs and Drives was added in a subsequent update to (version 10.13.4) on March 29, 2018, extending APFS compatibility to traditional spinning drives. Adoption of APFS accelerated following its introduction, with the macOS High Sierra installer providing a nondestructive in-place from HFS+ for existing SSD-based systems, making it opt-in for upgrades but mandatory for new installations on SSD volumes starting in 2017. For HDD-equipped Macs, users could opt in via manual formatting or later updates, while all new macOS installations post-High Sierra defaulted to APFS on compatible hardware to leverage its performance benefits. By (10.14) in 2018 and subsequent releases, APFS became the required for on SSDs, solidifying its role across Apple's platforms.

Versions and Updates

The Apple File System (APFS) has evolved through successive macOS releases, with version numbers tied to the underlying build identifiers that reflect incremental improvements in functionality, performance, and security. APFS debuted in (10.13) in September 2017 with 748.1.46, initially optimized for solid-state drives (SSDs) and converting compatible volumes automatically during installation. Subsequent updates within High Sierra refined this foundation, such as 748.21.6 in 10.13.1, which addressed snapshot stability issues. In (10.14), released in September 2018, APFS advanced to version 945.200.129, introducing support for hard disk drives (HDDs) and restoring compatibility with Fusion Drives, which had been dropped in High Sierra. This update enabled broader hardware support while maintaining and capabilities. By (10.15) in 2019, version 1412.11.7 added System Volume Groups and firmlinks for separating system and data volumes, enhancing security isolation. (11) in 2020 brought version 1677.50.1, incorporating signed system volumes, native backups to APFS-formatted drives, and optimizations for . Monterey (12) used versions 1933.x.x and 1934.x.x, with minor refinements like trim-on-mount for better storage efficiency. Later releases continued this progression: (13) in 2022 adopted version 2142.x.x, improving compatibility for backups with prior APFS volumes from Monterey and enabling trimming of unified disk read-write (UDRW) images as sparse files for more efficient handling. (14) shifted to 2235.x.x (up to 14.3) and 2236.x.x (14.4 onward) in 2023–2024, with incremental performance tweaks; Sonoma 14.6 in July 2024 fixed an APFS issue (CVE-2024-40783) by restricting data container , preventing malicious apps from bypassing user preferences. (15), starting with version 2311.x.x in 2024 and updated through 15.7 in 2025, included further enhancements, such as improved in APFS to mitigate unauthorized to sensitive user data (CVE-2024-54541). (16), released in September 2025, introduced version 24xx.x.x with additional refinements for storage efficiency and , including better support for Apple Intelligence features and optimizations. APFS maintains strong across macOS versions, allowing newer systems to read and write volumes created on older ones, though advanced features like system volume groups require macOS 10.15 or later. Conversely, macOS 10.12 and earlier can only read APFS volumes (via developer tools) but cannot write or boot from them, ensuring no downgrades without third-party conversion tools. Bootable APFS volumes demand macOS 10.13 or newer, while data volumes are supported starting from 10.13 for full read/write access. On , APFS launched in version 10.3 (2017) with basic snapshot support for efficient backups, evolving alongside macOS; (2023) enhanced snapshot handling for faster synchronization and device restores, leveraging APFS's mechanism to minimize data duplication during updates. iOS 18 (2024) and iOS 19 (2025) further optimized APFS for Apple Intelligence, improving backup efficiency and integration with on-device processing. These updates prioritize stability and security, with Apple recommending the latest tools for volume management to avoid pitfalls in multi-boot setups.

Architecture

Containers and Volumes

The Apple File System (APFS) employs containers and volumes as its core organizational structures to manage storage efficiently at the disk level. An APFS container represents a single logical entity that encompasses the entire physical disk or a designated , overseeing the allocation of blocks and for all associated volumes. This design enables multiple volumes to coexist and dynamically share the available physical space, allowing each to expand or contract as needed without requiring fixed size allocations in advance. Volumes function as logical partitions housed within an APFS container, where each operates as a distinct complete with its own independent for organizing files and directories. Managed through the container's object map, volumes store their specific , such as superblocks and file system trees, enabling isolated mounting and access. A container supports a maximum of 100 volumes, each assigned a unique virtual object identifier from the container's array. Starting with macOS 10.15 (), APFS introduces a specialized separation of the system volume and data volume to bolster system integrity and . The system volume, designated with the role APFS_VOL_ROLE_SYSTEM, holds read-only operating system components and is sealed with cryptographic hashes to prevent tampering. In contrast, the data volume, marked as APFS_VOL_ROLE_DATA, accommodates mutable user files, applications, and other writable content. These volumes are logically combined into a volume group, appearing to users as a unified space while maintaining their distinct roles for protection. APFS containers support multi-boot configurations by accommodating multiple bootable system volumes within the same shared space, such as for stable and beta macOS installations, along with supporting volumes like preboot (APFS_VOL_ROLE_PREBOOT) and recovery (APFS_VOL_ROLE_RECOVERY). This setup allows efficient resource utilization across operating system instances without duplicating storage. Conversion from the legacy Hierarchical File System Plus (HFS+) to APFS entails creating a new APFS container on the target disk and migrating the existing HFS+ volumes into corresponding APFS volumes, ensuring no data loss through a structured process of metadata conversion, verification, and superblock updates. This non-destructive migration occurs automatically during upgrades to macOS High Sierra (10.13) or later, capitalizing on intentional architectural parallels between the two systems for seamless compatibility.

Partition Scheme

The Apple File System (APFS) employs the GUID Partition Map () as its underlying partitioning scheme, which is the standard for modern macOS installations on and Apple silicon-based Macs. This scheme divides the physical storage device into partitions, where APFS operates primarily within designated containers that function as logical partitions. GPT enables support for disks larger than 2 terabytes and provides robust identification through unique GUIDs, ensuring compatibility with the Extensible Firmware Interface (EFI) boot process. APFS containers are identified by the partition type GUID 7C3457EF-0000-11AA-AA11-00306543ECAC, labeled as "Apple_APFS" in tools like . Unlike traditional fixed-size partitions, APFS containers are resizable and allocate disk space dynamically on demand, allowing the container to grow or shrink without reformatting the underlying structure. This UUID-based identification ensures uniqueness across devices and facilitates operations like or migration, where the container's UUID remains consistent even as its physical boundaries adjust. Supporting partitions, such as the (GUID C12A7328-F81F-11D2-BA4B-00A0C93EC93B), coexist alongside the main APFS container to store bootloaders and essentials. In the macOS boot process, the loads the initial , which then accesses the APFS container to the root volume and proceed with initialization. Additional specialized APFS partitions, like the Preboot volume (GUID 69646961-6700-11AA-AA11-00306543ECAC) for storing caches and the volume (GUID 52637672-7900-11AA-AA11-00306543ECAC) for diagnostic tools, integrate seamlessly within the GPT layout to support secure and efficient booting, particularly for encrypted volumes. This setup contrasts with the predecessor Hierarchical File System Plus (HFS+), which relied on the "Apple_HFS" (GUID 48465300-0000-11AA-AA11-00306543ECAC) and required separate physical partitions for distinct volumes or functions, such as and areas. APFS streamlines this by consolidating multiple volumes into a single resizable container, eliminating the need for multiple dedicated partitions and enabling shared free space allocation for greater efficiency.

Key Features

Cloning and Snapshots

APFS supports efficient of files and through its (COW) mechanism, which enables instantaneous duplication without initially copying the underlying data blocks. When a file or is , APFS creates a new inode referencing the same physical blocks as the original, marked by flags such as INODE_WAS_CLONED and INODE_WAS_EVER_CLONED in the inode structure. This shared storage persists until modifications occur to either the clone or the original, at which point new blocks are allocated via COW to maintain . Users can perform cloning at the command line using the cp -c option for or cp -Rc for , ensuring space-efficient copies within the same volume. Snapshots in APFS provide read-only, point-in-time representations of an entire volume, capturing its state without duplicating data through the same COW architecture. These snapshots are created using the tmutil localsnapshot command or the fs_snapshot_create , allowing for quick generation typically in milliseconds regardless of volume size. Once created, snapshots are stored as records in the volume's structures, including details like creation time and extent references, and can be listed or deleted via or command-line tools like tmutil listlocalsnapshots. They serve as the foundation for local backups and enable rollbacks to previous states. At the core of both cloning and snapshots is APFS's block-based COW , which organizes metadata and data extents in structures for efficient mapping and updates. The object map () B-tree maps virtual object IDs to physical addresses, facilitating COW operations by redirecting writes to new locations while preserving historical references in snapshots. Each volume supports a theoretical maximum of UINT32_MAX snapshots, though practical limits are imposed by available storage space and system resources. Exemptions from COW, such as for certain system files, are tracked via extended attributes to ensure compatibility. A primary use case for APFS snapshots is during macOS system updates, where the installer automatically creates a before applying changes, allowing users to revert to the pre-update state if issues arise. This feature enhances reliability for software installations and maintenance tasks, such as restoring from local snapshots in recovery mode.

Encryption and Security

APFS provides native support for full-volume , utilizing the AES-XTS with either 128-bit or 256-bit keys depending on the . This is applied at the level, protecting both file data and across volumes. On devices with through A18 or through M4 processors, APFS employs AES-256 in XTS mode, where a 256-bit per-file key is subdivided for per-extent to enhance and . Older , such as A9 through A13 or S5 through S9, uses AES-128 in XTS mode with corresponding 128-bit tweaks and cipher keys. This built-in capability integrates seamlessly with , Apple's full-disk feature, which leverages APFS to secure all on the boot volume without requiring additional third-party tools. Key management in APFS relies on a hierarchical structure centered around volume encryption keys (VEKs) and key encryption keys (KEKs). Each APFS volume is created with a default VEK that encrypts its contents, including metadata, while per-file keys—derived and managed by the Secure Enclave—are used for individual file protection. These keys are generated using a true random number generator within the Secure Enclave and can be derived from user credentials, such as passwords or passcodes, via PBKDF2, or from hardware-bound unique identifiers (UIDs) tied to the device. Multi-key support is enabled through keybags, which store multiple wrapped keys (e.g., user, device, escrow, or iCloud recovery keys) associated with volume group UUIDs, allowing flexible access control and recovery options without exposing plaintext keys to the application processor. On Macs with T2 chips or Apple Silicon, the Secure Enclave handles key derivation and storage, ensuring keys remain isolated and protected even if the main storage is removed. APFS defines security levels through Data Protection classes, mapped to numeric identifiers: SL 1 (Class A, Complete Protection), SL 2 (Class B, Protected Unless Open), SL 3 (Class C, Protected Until First User Authentication), SL 4 (Class D, No Protection), and additional classes like SL 6 (Class F) or SL 14 (Class M) for specialized uses. These levels determine file accessibility based on device state—such as locked, after first unlock, or during specific operations—with keys unlocked progressively via user authentication. SL 1 provides the highest protection, requiring authentication before access and becoming inaccessible shortly after the device locks, while SL 3 (the default for most user data on modern devices) becomes accessible after the first user authentication following reboot and remains accessible until the next reboot. In modern macOS on devices, the default is SL 3 (Class C), balancing accessibility and security for most user data after initial unlock. To optimize performance, APFS leverages via dedicated engines in SoCs and security chips, enabling inline and decryption of NAND flash without software overhead. This hardware integration ensures that cryptographic operations occur transparently during I/O, with keys never exposed outside the Secure Enclave, thereby maintaining high throughput even for encrypted volumes. For external or unsupported , APFS falls back to software-based , but internal volumes on compatible benefit from this acceleration for efficient full-volume protection.

Compression and Space Sharing

APFS supports transparent inline applied to individual files, which reduces overall space usage and minimizes write operations to extend the lifespan of SSDs. This is handled automatically by the without user intervention, allowing files to be stored in a compressed form on disk while appearing uncompressed to applications. The algorithms employed include LZVN for fast suitable for Apple platforms, LZFSE for efficient , and Zlib for balanced performance across systems. A key aspect of APFS is space sharing, where multiple volumes within a single dynamically share the available free space without fixed quotas or pre-allocated partitions. This allocation occurs automatically as needed, with the space manager allocating and freeing blocks across volumes to optimize storage efficiency. Unlike traditional partitioning schemes, this approach eliminates wasted space from underutilized volumes and simplifies management in multi-volume environments. APFS imposes generous theoretical limits to support massive datasets, allowing up to 9 quintillion files per and a maximum size of 8 exabytes. These limits stem from the file system's 64-bit , enabling for large-scale storage needs on modern hardware. In multi-volume setups, such as the separation of system and data volumes in macOS 10.15 and later, space sharing provides efficiency by allowing the read-only system volume and writable data volume to dynamically utilize the container's shared pool without rigid size constraints. This design enhances storage utilization while maintaining logical separation for purposes.

Data Protection

Integrity Mechanisms

APFS ensures the integrity of its through the use of embedded in every object. Each object includes a Fletcher-64 , a non-cryptographic computed over the object's data excluding the checksum field itself, stored in the o_cksum field of the obj_phys_t structure. This 8-byte checksum is verified during read operations to detect any alterations or corruption in metadata blocks, such as those representing B-trees, inodes, and other structural elements. The Fletcher-64 , consisting of two 32-bit accumulators, provides efficient detection of errors with low computational overhead, suitable for frequent metadata access. In contrast to metadata, user data blocks in APFS do not receive file system-level checksumming, relying on the error-correcting code (ECC) capabilities of the underlying NAND flash hardware for bit error detection and correction. This design choice balances integrity assurance with the efficiency demands of modern SSDs, where metadata—being smaller in volume—is prioritized for checksum validation to safeguard overall file system consistency. Additionally, the Signed System Volume (SSV), introduced in , uses SHA-256 cryptographic hashes in a structure to verify the integrity of both system and , with a root seal checked at boot to prevent tampering. A core integrity mechanism in APFS is its (COW) approach to modifications, which eliminates the risk of partial writes that could corrupt structures during power loss or crashes. When updating , such as an inode or node, APFS allocates a new block, copies the unchanged portions, applies modifications, computes the , and writes the new version to disk. Only after successful writing does the update the parent pointer to reference the new block, leaving the original intact until garbage collection. This atomic update process, combined with periodic checkpoints that snapshot the container's root state, ensures that the always mounts to a consistent, valid configuration without requiring repairs in most failure scenarios. APFS eschews traditional journaling mechanisms found in predecessors like HFS+, opting instead for COW and checkpoints to achieve equivalent or superior consistency guarantees for . HFS+ employed a dedicated to log and replay pending transactions, but this introduced overhead and vulnerability to . In APFS, the absence of journaling reduces on flash media while leveraging COW to provide transactional semantics inherently, resulting in stronger protection overall. However, this shift means user data lacks the proactive integrity logging of HFS+, placing greater emphasis on storage-level reliability for long-term data preservation.

Crash Protection

The Apple File System (APFS) employs a (COW) scheme to provide robust crash protection, ensuring that updates are and consistent even in the event of power failures or system crashes. Unlike traditional journaling , which incur a "write-twice" overhead by changes before committing them, APFS's COW approach modifies by writing new versions to unused space rather than overwriting existing data. This mechanism guarantees that operations such as file creation, deletion, or directory renames either complete fully or roll back entirely, preventing partial updates that could lead to inconsistencies. APFS further enhances through snapshot-based mechanisms, where the maintains read-only of at key points, such as during or major updates. In the case of a crash, the system can automatically revert to the most recent valid snapshot or checkpoint, restoring a consistent pre-crash state without . These snapshots are integral to bootable volumes in macOS, allowing the recovery partition to mount and repair from a known-good state if the primary is compromised. This leverages the container's to store ephemeral objects that protect against interruptions, ensuring quick and reliable on SSD storage. For post-crash repair, APFS includes the fsck_apfs , which scans and fixes inconsistencies by verifying redundant structures like checkpoints, B-trees, and object maps. The uses transaction identifiers (xids) to validate the integrity of ongoing operations, repairing issues such as orphaned inodes or mismatched snapshots without requiring full volume scans in most cases. It operates in modes for checking, repairing, or dry-running, and is invoked automatically by Disk Utility's or manually in environments. While APFS's COW and features offer efficient protection tailored to , they introduce some considerations during intensive write operations on SSDs. The need to allocate new blocks for each modification can increase CPU usage for management, particularly under heavy workloads like large file copies or frequent updates, though this is mitigated by in-memory caching for ephemeral objects. Overall, this approach avoids the I/O penalties of journaling while maintaining .

Limitations

Performance Characteristics

APFS is optimized for solid-state drives (SSDs), leveraging features like support to maintain high by allowing the operating system to inform the SSD of unused blocks for efficient garbage collection. This integration helps sustain consistent read and write speeds, particularly as the drive fills. The file system's () metadata scheme further aids SSD by minimizing , distributing data blocks to avoid concentrated wear on specific cells. Apple's highlights that these optimizations enable high-performance parallelized metadata operations. On hard disk drives (HDDs), APFS faces notable limitations stemming from its COW-based patterns, which promote and fragmentation over time. This results in excessive operations by the read/write head, degrading for operations involving scattered . Independent analysis shows enumeration times on APFS-formatted HDDs ranging from 3 to 20 times slower than on HFS+-formatted equivalents, with initial listings taking about seconds versus 20-27 seconds, worsening to 300-380 seconds after repeated cycles. Due to these issues, Apple has not recommended APFS for drives in versions prior to 2018 updates, as the system's design prioritizes flash storage characteristics. APFS provides built-in defragmentation that can be enabled via command-line tools, such as diskutil apfs defragment, along with opportunistic defragmentation for files exceeding 20 during access. However, these features do not significantly improve on HDDs. APFS lacks support for third-party defragmentation tools traditionally used with HFS+. As of macOS 26 (Tahoe) in 2025, performance issues on rotational media persist. For key metrics, file creation and deletion on SSDs benefit from near-instant COW clones, often completing in milliseconds, while on HDDs these operations can extend to seconds due to physical constraints.

Compatibility Issues

Prior to (version 11, released in 2020), backups on APFS-formatted volumes were incompatible with native APFS snapshots, necessitating a using a sparsebundle to emulate an HFS+ within the APFS . This approach relied on hard links for efficient incremental backups but introduced overhead and limitations, such as the inability to leverage APFS's direct snapshot capabilities. With the introduction of , gained native support for APFS volumes, enabling faster and more efficient backups without the sparsebundle intermediary. APFS provides native read and write support exclusively on Apple platforms, including macOS, , , , and , due to its design optimized for these ecosystems. On non-Apple operating systems like Windows or , APFS volumes are not natively readable or writable, requiring third-party drivers—such as APFS for Windows—for access, where read support is generally available but write functionality remains limited and may not fully support advanced features like snapshots or . Downgrading an APFS volume to HFS+ (Mac OS Extended) is not possible through non-destructive conversion, as the file systems have fundamentally different structures; reverting requires erasing the volume entirely via , which deletes all data and necessitates a full process beforehand. This limitation stems from APFS's container-based , which cannot be directly mapped back to HFS+ without reformatting the underlying physical disk or . Some legacy applications encounter compatibility issues when running on APFS volumes, particularly in early implementations like , due to differences in how extended attributes and file metadata are handled compared to HFS+. For instance, CC 2017 exhibited launch failures and file access problems on APFS-formatted drives, as the software relied on HFS+-specific behaviors for extended attributes that were not yet fully compatible. In APFS, extended attributes are stored separately from file inodes and data, which can disrupt older apps expecting integrated metadata storage, though subsequent macOS updates and app patches have mitigated many such issues. As of 2024, APFS continues to have incompatibilities including the expansion of sparse files when moved or copied, the loss of clone file preservation during such operations, the inability to copy snapshots in backups, and lack of for hard links.

Platform Support

macOS Integration

(APFS) has been the default for all new installations of (version 10.13) and subsequent releases on computers equipped with flash or . This shift prioritizes APFS's optimizations for SSDs, including features like snapshots and space sharing, while maintaining compatibility with external and mechanical drives formatted in other systems. For users upgrading from earlier macOS versions, the installer automatically converts compatible HFS+ volumes on solid-state drives to APFS non-destructively, preserving data and enabling seamless adoption without manual intervention. macOS integrates APFS with platform-specific security enhancements, notably signed system volumes introduced in (10.15). This mechanism splits the boot volume into a read-only system volume and a writable data volume within an APFS container, using cryptographic hashes and a structure to verify file integrity and prevent tampering. APFS snapshots underpin this by supporting updates and if installations fail, ensuring system . In (11.0) and later, the signed system volume incorporates sealed snapshots, which mount the OS read-only with a cryptographic seal verified at boot, further bolstering protection against and unauthorized changes. APFS volume management in macOS is facilitated through built-in tools tailored for user accessibility and advanced control. offers a graphical for creating, resizing, erasing, and deleting APFS volumes within containers, with options to set quotas or reserves for space allocation and view snapshots directly. For command-line operations, the diskutil utility provides APFS-specific verbs, such as diskutil apfs addVolume to create new volumes, diskutil apfs cloneVolume for efficient via , and diskutil apfs snapshot to generate point-in-time for backups or testing. These tools enable precise handling of APFS features like and without third-party software. As of macOS Sequoia 15.7.2 (November 2025), APFS receives full native support across all compatible hardware, serving as the exclusive file system for boot volumes on Macs (M-series chips and later). APFS continues to serve as the foundational storage layer for macOS, with no alternatives available for internal system volumes on these devices.

iOS, tvOS, and watchOS

APFS was first introduced to in version 10.3, released in March 2017, where it automatically converted the file system from HFS+ to APFS on compatible devices including the and later models, preserving existing user data during the update process. With the release of in September 2017, APFS achieved full adoption as the native file system, enabling broader utilization of its features tailored for mobile environments. In , tvOS, and watchOS, APFS incorporates optimizations suited to the resource-constrained nature of flash-based storage in mobile and embedded devices, such as efficient mechanisms and support for non-contiguous file allocation to minimize wear on NAND flash. Encryption is enabled by default across these platforms, with APFS leveraging the Secure Enclave to generate and manage per-file encryption keys, ensuring is protected without intervention. Unlike macOS implementations, APFS in does not provide user-accessible snapshots; these are managed internally by the system for tasks like software updates and , remaining hidden from end users to maintain and simplicity. In and , APFS configurations emphasize security through read-only system volumes, where core operating system files are stored on signed, immutable partitions that prevent unauthorized modifications, enhancing resistance to tampering on devices like and . Recent updates, including 19 and 12 released in September 2025, incorporate security enhancements for APFS; for instance, 12.1 addressed vulnerabilities including an APFS issue (CVE-2025-XXXXX) that could allow apps to access sensitive user data via improper handling. As of November 2025, APFS remains fully compatible with the latest hardware, supporting devices such as the 16 series running 19.x, as well as Series 10 under 12.x, ensuring seamless integration with advanced Secure Enclave features in newer silicon.

Third-Party Tools

Several third-party tools enable reading and writing APFS volumes on non-Apple platforms, addressing the lack of native support in Windows and environments. Paragon Software's APFS for Windows provides full read and write access to APFS-formatted drives, supporting volumes from macOS 12 Monterey onward, including detection of FileVault-encrypted containers, though cloned files and snapshots remain read-only. As of 2025, version 4.0 supports through 11 and various server editions, allowing seamless file operations via Windows Explorer. Similarly, Paragon's APFS for offers equivalent read/write capabilities for APFS volumes on systems, enabling data exchange without reformatting. For cross-platform browsing, UFS Explorer Standard Access serves as a versatile tool that mounts and explores APFS volumes across Windows, macOS, and , facilitating file recovery and inspection without write modifications. In forensics, Elcomsoft iOS Forensic Toolkit (EIFT) facilitates APFS image acquisition from devices, including older models like to 5c lacking Secure Enclave Processors. The 2025 updates, such as version 8.81, extend support to APFS-based Series 0 and enhance decryption of software-encrypted volumes using an integrated driver, allowing read-only mounting on multiple OSes after key extraction. This enables investigators to access full dumps, though passcode cracking is required for protected devices. Utilities like Blackmagic Disk Speed Test benchmark APFS performance on macOS, measuring sequential read/write speeds with large video file simulations to evaluate drive throughput, often exceeding 1,000 MB/s on modern SSDs. Apple provides no official SDK for third-party APFS development, leaving developers reliant on reverse-engineered or proprietary libraries. Despite these advancements, third-party APFS tools carry limitations, including risks of from incomplete write implementations in non-official drivers. Open-source efforts like apfs-fuse offer read-only access via on , supporting (Zlib/LZVN) and software but lacking write functionality, LZFSE support, and hardware compatibility, thus lagging behind Apple's evolving APFS features.

References

  1. [1]
    Role of Apple File System
    Dec 19, 2024 · Apple File System (APFS) is a proprietary file system that was designed with encryption in mind. APFS works across all Apple's platforms.
  2. [2]
    Apple File System Guide
    Jun 4, 2018 · APFS replaces HFS+ as the default file system for iOS 10.3 and later, and macOS High Sierra and later.
  3. [3]
    File system formats available in Disk Utility on Mac - Apple Support
    Apple File System (APFS), the default file system for Mac computers using macOS 10.13 or later, features strong encryption, space sharing, snapshots, fast ...
  4. [4]
    Frequently Asked Questions - Apple Developer
    Jun 4, 2018 · These file systems were developed in an era of floppy disks and ... filesystem from HFS+ to APFS. For example, attempting to create a ...
  5. [5]
    [PDF] Introducing Apple File System
    APFS is coming soon. Please test your apps against APFS with the WWDC macOS build. (and run them on APFS). Page 157. Takeaways. APFS is coming soon. Please test ...
  6. [6]
    A ZFS developer's analysis of the good and bad in Apple's new ...
    Jun 26, 2016 · Apple will be delivering APFS broadly with 3-4 years of development so will need to accelerate quickly to maturity. Paying down debt. HFS was ...Missing: limitations | Show results with:limitations
  7. [7]
    macOS High Sierra now available as a free update - Apple
    Sep 25, 2017 · APFS brings support for the latest high-capacity storage devices and delivers enhanced performance, security and reliability. With APFS, common ...
  8. [8]
    A brief history of APFS in honour of its fifth birthday
    Apr 1, 2022 · This means that anything that interrupts a write to a disk risks leaving an HFS+ file system in an unstable, damaged state. APFS addresses that ...Missing: limitations | Show results with:limitations
  9. [9]
    APFS versions, updates and compatibility
    Sep 2, 2023 · What's in APFS, and what are its tools? How to interpret the version number, and what do we know has changed with different versions?Missing: list | Show results with:list
  10. [10]
    Dual-booting your Mac with multiple versions of APFS
    Aug 22, 2024 · x.x is 13 Ventura; 2235.x.x is 14 Sonoma up to 14.3; 2236.x.x is 14.4 Sonoma and later; 2311.x.x and later is macOS 15 Sequoia beta. Dangers. To ...
  11. [11]
    Disk Utility and Time Machine in Ventura - The Eclectic Light Company
    Nov 9, 2022 · Most importantly, they appear compatible with backups in Monterey, so there's no requirement to convert or alter previous backups made to APFS ...
  12. [12]
    About the security content of macOS Sonoma 14.6 - Apple Support
    Description: A buffer overflow issue was addressed with improved memory handling. CVE-2024-27878: CertiK SkyFall Team. CVE-2024-44306: CertiK SkyFall Team.
  13. [13]
    iOS APFS Snapshots - Corellium Support Center
    An APFS snapshot begins to consume space only when data that existed at the time of the snapshot is modified or deleted. Because snapshots are immutable, APFS ...
  14. [14]
    [PDF] Apple File System Reference
    Jun 22, 2020 · Apple File System is the default file format used on Apple platforms. Apple File System is the successor to HFS.
  15. [15]
    What's New in Apple File Systems - WWDC19 - Videos
    May 23, 2019 · Learn about what's new in file system technology, including changes to file system layout and imaging technologies.
  16. [16]
    Partition schemes available in Disk Utility on Mac - Apple Support
    Disk Utility on Mac supports several partition map schemes: GUID Partition Map, Master Boot Record, and Apple Partition Map.
  17. [17]
    About Apple File System | Apple Developer Documentation
    Use high-level APIs to get the most out of Apple File System.Missing: maximum volume size
  18. [18]
    About Time Machine local snapshots - Apple Support
    Sep 23, 2025 · Time Machine lets you restore files from local snapshots of the files on your Mac, even when your Time Machine backup disk isn't available.Missing: documentation | Show results with:documentation
  19. [19]
    View APFS snapshots in Disk Utility on Mac - Apple Support
    Go to the Disk Utility app on your Mac. If Disk Utility isn't open, click · Choose View > Show APFS Snapshots. · In the sidebar, select a volume. · Select a ...<|control11|><|separator|>
  20. [20]
    Data Protection overview - Apple Support
    Dec 19, 2024 · On A14 through A18 and M1 through M4 devices, the encryption uses AES-256 in XTS mode, where the 256-bit per-file-key goes through a Key ...
  21. [21]
    COMPRESSION_ZLIB | Apple Developer Documentation
    The zlib compression algorithm, which is recommended for cross-platform compression.
  22. [22]
    Features - Apple Developer
    Jun 4, 2018 · Apple File System supports the following encryption models for each volume in a container: No encryption. Single-key encryption. Multi-key ...
  23. [23]
    See if your Mac shares space across APFS volumes - Apple Support
    If a single APFS partition (or container) has multiple volumes, the container's free space is shared and can be allocated to any of the volumes as needed.Missing: dynamic | Show results with:dynamic
  24. [24]
    Volume Format Comparison - Apple Developer
    Jun 4, 2018 · Volume Format Comparison. Mac OS Extended (HFS+). Apple File System (APFS) ... Space sharing. ✓. Native encryption. ✓. Sparse files. ✓. Fast ...
  25. [25]
    [PDF] Apple Platform Security
    Since its introduction, APFS has provided file-system metadata integrity using noncryptographic checksums on the internal storage device. SSV strengthens ...
  26. [26]
    Tools and APIs - Apple Developer
    Jun 4, 2018 · fsck_apfs. fsck_apfs. Enhanced APIs. Foundation / FileManager. func copyItem(atPath srcPath: String,. toPath dstPath: String) throws. func ...
  27. [27]
    APFS Explained: A Deep Dive Into the New Apple File System for ...
    Mar 27, 2017 · APFS first appeared with macOS 10.12 Sierra as an early test release for developers to try out. Its first general release is iOS 10.3. Apple ...
  28. [28]
    APFS vs. HFS+: Why APFS is Superior File System - Hetman Software
    Jun 18, 2025 · We'll explore the various advantages that APFS offers over HFS+, including enhanced performance, improved reliability, and advanced features ...
  29. [29]
    An analysis of APFS enumeration performance on rotational hard ...
    Sep 12, 2019 · APFS enumeration on rotational HDDs takes 3-20x longer than HFS+ due to the drive head constantly moving to fetch each file and folder record.
  30. [30]
  31. [31]
    Should you enable defragmentation on APFS hard drives?
    Oct 19, 2019 · Enabling defragmentation in APFS doesn't cause file system metadata to be consolidated into storage areas which reduce or eliminate seek time on a hard disk.
  32. [32]
    Blog - Seven Years of APFS - Michael Tsai
    Apr 3, 2024 · @Michael Anecdotally, enabling APFS defragmentation helped restore performance for an external HDD of mine that, after converting it to APFS, ...Missing: improvements | Show results with:improvements
  33. [33]
    APFS changes in Big Sur: how Time Machine backs up to APFS ...
    Jun 29, 2020 · Big Sur is the first version of macOS which can make Time Machine backups to APFS volumes without using a virtual HFS+ file system on a sparse bundle.
  34. [34]
    APFS changes affect Time Machine in macOS Big Sur, encrypted ...
    Jun 27, 2020 · Apple is increasing its support for APFS on its computing platforms, bringing the ability to use Time Machine with an APFS-formatted disk to macOS Big Sur.<|separator|>
  35. [35]
    If Time Machine takes a long time to back up - Apple Support
    Upgrade macOS and use an APFS-formatted backup disk. If you're using the same Time Machine backup disk that you were using before upgrading to macOS Big Sur or ...
  36. [36]
    APFS for Windows - Paragon Software
    APFS for Windows allows Windows computers to read and write files on APFS-formatted drives, mounting them in read-write mode.<|control11|><|separator|>
  37. [37]
    Erase and reformat a storage device in Disk Utility on Mac
    In Disk Utility on Mac, you can erase and reformat storage devices to use with your Mac. Erasing a storage device deletes everything on it.
  38. [38]
  39. [39]
    Pro apps' APFS compatibility leads to a rough High Sierra transition
    Oct 5, 2017 · In one example of compatibility problems, users have run into issues with Adobe Illustrator CC 2017 running on High Sierra Macs with APFS drives ...
  40. [40]
    APFS: Extended attributes revisited - The Eclectic Light Company
    May 13, 2024 · In APFS, a file's xattrs aren't stored in the file's inode with its file system attributes, nor with that file's data, but are kept separately.Missing: legacy | Show results with:legacy
  41. [41]
    Signed system volume security - Apple Support
    May 13, 2022 · Signed system volume security. In macOS 10.15, Apple introduced the read-only system volume, a dedicated, isolated volume for system content.
  42. [42]
    Add, delete, or erase APFS volumes in Disk Utility on Mac
    Add, delete, or erase APFS volumes in Disk Utility on Mac. Apple File System (APFS) allocates disk space on demand. When a single APFS container (partition) ...
  43. [43]
    diskutil Man Page - macOS - SS64.com
    See the mount_apfs(8) -s and fs_snapshot_create(2) commands. However, it ... View a list of volume owners on a Mac with Apple silicon, this will return ...
  44. [44]
    About the security content of macOS Sequoia 15.2 - Apple Support
    This document describes the security content of macOS Sequoia 15.2.
  45. [45]
    macOS Sequoia is compatible with these computers - Apple Support
    Sep 15, 2025 · macOS Sequoia is compatible with these computers · MacBook Pro · MacBook Air · iMac · iMac Pro · Mac mini · Mac Studio · Mac Pro · Apple Footer.
  46. [46]
    A tour of iOS 10.3: Checking out APFS, the Settings app, and other ...
    Mar 27, 2017 · APFS. iOS 10.3 will automatically convert your iDevice's filesystem from HFS+ to APFS when you install it, making it the first Apple operating ...
  47. [47]
    Apple is upgrading millions of iOS devices to a new modern file ...
    Mar 27, 2017 · Within iOS 10.3, Apple is moving supported devices to its new Apple File System (APFS). It's a file system that was originally announced at WWDC ...
  48. [48]
  49. [49]
    APFS explained; what you need to know for iOS 10.3 and macOS
    Mar 21, 2017 · Recently released with the iOS 10.3 beta, APFS will soon replace your Apple device's thirty year old file system. This means your Apple ...
  50. [50]
    Secure Enclave - Apple Support
    Dec 19, 2024 · The Secure Enclave is a dedicated secure subsystem in the latest versions of iPhone, iPad, Mac, Apple TV, Apple Watch, Apple Vision Pro, and HomePod.
  51. [51]
  52. [52]
    Android Device Encryption vs iOS Device Encryption - Hexnode UEM
    Aug 11, 2025 · Secure Enclave and APFS (Apple File System) file-level keys: The Secure Enclave plays a critical role in storing and managing cryptographic ...<|separator|>
  53. [53]
    Top 5 questions about APFS and macOS High Sierra asked by Mac ...
    Mar 28, 2018 · Unlike in previous macOS versions, the content of local snapshots in APFS is entirely unreachable to the user, even if you search with raised ...
  54. [54]
    About the security content of watchOS 11.2 - Apple Support
    Released December 11, 2024. APFS Available for: Apple Watch Series 6 and later. Impact: An app may be able to access user-sensitive data.
  55. [55]
    About the security content of iOS 18 and iPadOS 18 - Apple Support
    iOS 18 and iPadOS 18 Released September 16, 2024 Accessibility Available for: iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and ...Missing: APFS | Show results with:APFS
  56. [56]
    Apple Watch and iPhone compatibility
    Sep 22, 2025 · Find out which versions of iPhone, iOS, and watchOS work with your Apple Watch. Updating to iOS 18 requires iPhone XS or later.Missing: APFS hardware
  57. [57]
    watchOS 11 is available today - Apple
    UPDATE September 16, 2024. watchOS 11 is available today. Introducing sleep apnea notifications, the Vitals app, training load, additional customization for ...Sleep Apnea Notifications · Vitals App · Training LoadMissing: APFS | Show results with:APFS
  58. [58]
    APFS for Windows - Paragon Software
    If you work on a Windows-based computer and want to read and write files on APFS-formatted HDD, SSD or flash drive, you need APFS for Windows by Paragon ...
  59. [59]
    APFS for Linux - Paragon Software
    Full read/write access to APFS volumes! APFS for Linux by Paragon Software is a driver for the access to the APFS-formatted volumes from a Linux environment.
  60. [60]
    Perfect Acquisition Part 5: Perfect APFS Acquisition - ElcomSoft blog
    Jul 21, 2025 · Using the S0, we improved our in-house APFS implementation and can now decrypt and analyze data from raw iOS/WatchOS APFS dumps. Because ...
  61. [61]
    Elcomsoft iOS Forensic Toolkit
    In stockPerform full file system and logical acquisition of iPhone, iPad and iPod Touch devices. Image device file system, extract device secrets.
  62. [62]
    Blackmagic Disk Speed Test - App Store
    Disk Speed Test is an easy to use tool to quickly measure and certify your disk performance for working with high quality video!Missing: APFS | Show results with:APFS
  63. [63]
    Third-party SDK requirements - Support - Apple Developer
    Third-party software development kits (SDKs) can provide great functionality for apps; they can also have the potential to impact user privacy.
  64. [64]
    sgan81/apfs-fuse: FUSE driver for APFS (Apple File System) - GitHub
    This project is a read-only FUSE driver for the new Apple File System. It also supports software encrypted volumes and fusion drives.