±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 35765
New Yesterday: 3 Visitors: 127

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

New File System on Macs

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3, 4, 5  Next 
  

randomaccess
Senior Member
 

New File System on Macs

Post Posted: Jun 14, 16 03:53

developer.apple.com/li...ction.html

Apple's announced a new file system, APFS, which we'll start to see in 2017 with MacOS Sierra
"Apple File System supports nearly all of the features of HFS+, and offers improvements over HFS+, including 64-bit inode numbers, 1 nanosecond timestamp granularity, an expansive block allocator, support for sparse files, and a crash protection scheme."

"Apple File System provides several new features, including optimization for Flash/SSD storage, copy-on-write metadata, space sharing, cloning of files and directories, snapshots, fast directory sizing, and atomic safe-save primitives."  
 
  

Chris_Ed
Senior Member
 

Re: New File System on Macs

Post Posted: Jun 14, 16 11:47

It's interesting that not only do the "containers" support different levels of encryption, but it's up to developers whether they use it or not. One would assume that Apple's own software (such as MacOS) will use it by default, much like OSX does now. Also, APFS supports TRIM commands out the box.

Now the question is; which tools will support it first? My prediction:
1) XWF
2) Blackbag tools (Macquisition, etc)
3) Magnet Axiom
4) TSK
5) FTK
6) EnCase 8

Wink  
 
  

jaclaz
Senior Member
 

Re: New File System on Macs

Post Posted: Jun 14, 16 14:41

- Chris_Ed

My prediction:
1) XWF
2) Blackbag tools (Macquisition, etc)
3) Magnet Axiom
4) TSK
5) FTK
6) EnCase 8

My prediction:
1) XWF
2) Blackbag tools (Macquisition, etc)
3) Magnet Axiom
4) TSK
5) FTK
6) EnCase 8 (but poorly/partially, and only on machines with at least 256 Gb of RAM and 32 Ghz Shocked 64 cores processor) Wink

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

raydenvm
Member
 

Re: New File System on Macs

Post Posted: Jun 14, 16 16:23

I believe we should not spend much discussing the topic this year because of the following fact:

"Apple plans to document and publish the APFS volume format when Apple File System is released in 2017."
_________________
Vitaliy Mokosiy
CTO
Atola Technology 
 
  

citizen
Member
 

Re: New File System on Macs

Post Posted: Jun 17, 16 19:49

arstechnica.com/apple/...le-system/

An article a colleague shared earlier this week. Look forward to the full details being released.  
 
  

Logan
Senior Member
 

Re: New File System on Macs

Post Posted: Oct 03, 17 12:34

I assume no tool has released support for the new file system yet?

Contacted X-Ways; no support.

Cannot see support within EnCase or FTK...  
 
  

Deltron
Senior Member
 

Re: New File System on Macs

Post Posted: Oct 03, 17 13:06

Sumuri the maker of recon did a live video on this issue
www.youtube.com/watch?v=OX5H-RsKexI  
 

Page 1 of 5
Page 1, 2, 3, 4, 5  Next