±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34298
New Yesterday: 0 Visitors: 267

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

New File System on Macs

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3, 4, 5  Next 
  

New File System on Macs

Post Posted: Mon Jun 13, 2016 9:53 pm

developer.apple.com/li...ction.html

Apple's announced a new file system, APFS, which we'll start to see in 2017 with MacOS Sierra
"Apple File System supports nearly all of the features of HFS+, and offers improvements over HFS+, including 64-bit inode numbers, 1 nanosecond timestamp granularity, an expansive block allocator, support for sparse files, and a crash protection scheme."

"Apple File System provides several new features, including optimization for Flash/SSD storage, copy-on-write metadata, space sharing, cloning of files and directories, snapshots, fast directory sizing, and atomic safe-save primitives."  

randomaccess
Senior Member
 
 
  

Re: New File System on Macs

Post Posted: Tue Jun 14, 2016 5:47 am

It's interesting that not only do the "containers" support different levels of encryption, but it's up to developers whether they use it or not. One would assume that Apple's own software (such as MacOS) will use it by default, much like OSX does now. Also, APFS supports TRIM commands out the box.

Now the question is; which tools will support it first? My prediction:
1) XWF
2) Blackbag tools (Macquisition, etc)
3) Magnet Axiom
4) TSK
5) FTK
6) EnCase 8

Wink  

Chris_Ed
Senior Member
 
 
  

Re: New File System on Macs

Post Posted: Tue Jun 14, 2016 8:41 am

- Chris_Ed

My prediction:
1) XWF
2) Blackbag tools (Macquisition, etc)
3) Magnet Axiom
4) TSK
5) FTK
6) EnCase 8

My prediction:
1) XWF
2) Blackbag tools (Macquisition, etc)
3) Magnet Axiom
4) TSK
5) FTK
6) EnCase 8 (but poorly/partially, and only on machines with at least 256 Gb of RAM and 32 Ghz Shocked 64 cores processor) Wink

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: New File System on Macs

Post Posted: Tue Jun 14, 2016 10:23 am

I believe we should not spend much discussing the topic this year because of the following fact:

"Apple plans to document and publish the APFS volume format when Apple File System is released in 2017."
_________________
Vitaliy Mokosiy
CTO
Atola Technology 

raydenvm
Member
 
 
  

Re: New File System on Macs

Post Posted: Fri Jun 17, 2016 1:49 pm

arstechnica.com/apple/...le-system/

An article a colleague shared earlier this week. Look forward to the full details being released.  

citizen
Member
 
 
  

Re: New File System on Macs

Post Posted: Tue Oct 03, 2017 6:34 am

I assume no tool has released support for the new file system yet?

Contacted X-Ways; no support.

Cannot see support within EnCase or FTK...  

Logan
Senior Member
 
 
  

Re: New File System on Macs

Post Posted: Tue Oct 03, 2017 7:06 am

Sumuri the maker of recon did a live video on this issue
www.youtube.com/watch?v=OX5H-RsKexI  

Deltron
Senior Member
 
 

Page 1 of 5
Go to page 1, 2, 3, 4, 5  Next