PHASE: APFS File System50% COMPLETION
MODULE 12
Mac OS Forensics
APFS specifics, FSEvents, and property list (plist) analysis.
APFS File System
Apple File System (APFS) replaced HFS+ in 2017.
Key Features
- Native encryption support
- Snapshots (Time Machine)
- Space sharing between volumes