- Practical Mobile Forensics
- Rohit Tamma Oleg Skulkin Heather Mahalik Satish Bommisetty
- 244字
- 2021-06-24 16:39:04
The APFS structure
So, APFS is structured in a single container that may contain one or more volumes. The APFS structure is presented in the following diagram:
Overview of the APFS structure
Each filesystem structure in APFS starts with a block header. The block header starts with a checksum (Fletcher's checksum algorithm is used) for the whole block and also contains the copy-on-write version of the block, the block ID, and the block type.
The APFS structure can be explained as follows:
- The Container Superblock contains information on the block size, the number of blocks and pointers to the space manager for this task, the block IDs of all volumes, and a pointer to a block map B-Tree (which contains entries for each volume, along with its ID and offset).
- Nodes are used for storing different kinds of entries. They can be part of a B-Tree or exist on their own and can contain either flexible or fixed-sized entries.
- The Space Man(ager) manages the allocated blocks in the APFS container, and stores the number of free blocks and a pointer to the Allocation Info File.
- The Allocation Info File stores the allocation file's length, version, and the offset.
- The B-Trees manage multiple nodes and contain the offset of the root node.
- A Volume Superblock contains the name of the volume, its ID, and a timestamp.
As for allocation files, they are simple bitmaps and do not have a block header and type ID.
推薦閱讀
- Extending Symfony2 Web Application Framework
- Web漏洞分析與防范實(shí)戰(zhàn):卷1
- 數(shù)據(jù)恢復(fù)方法及案例分析
- Learning Python for Forensics
- 為你護(hù)航:網(wǎng)絡(luò)空間安全科普讀本(第2版)
- 黑客攻防入門秘笈
- Computer Forensics with FTK
- 數(shù)據(jù)安全領(lǐng)域指南
- API安全技術(shù)與實(shí)戰(zhàn)
- 網(wǎng)絡(luò)安全應(yīng)急響應(yīng)實(shí)戰(zhàn)
- 復(fù)雜信息系統(tǒng)網(wǎng)絡(luò)安全體系建設(shè)指南
- Hands-On Artificial Intelligence for Cybersecurity
- 功能型密碼算法設(shè)計(jì)與分析
- 網(wǎng)絡(luò)空間安全法律問題研究
- 安全網(wǎng)絡(luò)構(gòu)建