MacOS File System

Prepared By : Prabin Acharya

File System used on MacOS

➢
Mac OS Extended (HFS+): The file system used by macOS
10.12 or earlier.

➢
Apple File System (APFS): The file system used by
macOS 10.13 or later.

2
Mac OS Extended

●
known as HFS+, an upgrade from the original Mac OS Standard
Format known as HFS, or Hierarchical File System.
●
supports much larger files (block addresses are 32-bit length
instead of 16-bit), this means it can access 2^32 allocation
blocks.
●
volumes are divided into sectors that are usually 512 bytes in
size.
●
HFS+ does not support sparse files.
●
Doesn’t support snapshot and nano timestamps.
●
Data checksums are the most routinely cited missing feature.
●
Concurrent access of the file system by a process is not allowed.

3
Apple File System (APFS)

●
features strong encryption, space sharing, snapshots, fast
directory sizing and improved file system fundamentals.
●
is optimized for flash and solid-state drive storage, with a
primary focus on encryption.
●
APFS formats:
➢ APFS: Uses the APFS format.
➢ APFS (Encrypted): Uses the APFS format and encrypts the volume.
➢ APFS (Case-sensitive): Uses the APFS format and is case-sensitive to
file and folder names. For example, folders named “Homework” and
“HOMEWORK” are two different folders.
➢ APFS (Case-sensitive, Encrypted): Uses the APFS format, is case-
sensitive to file and folder names and encrypts the volume.

4
Benefits of APFS

●
supports snapshots for creating a point-in-time, read-only instance of the file system.
●
natively supports full disk encryption, and file encryption with the following options:
➢ no encryption
➢ single-key encryption
➢ multi-key encryption, where each file is encrypted with a separate key, and metadata is
encrypted with a different key.
●
supports 64-bit inode numbers, supporting over 9 quintillion files on a single volume.
●
uses checksums to ensure data integrity for metadata.
●
adds the ability to have multiple logical drives (referred to as Volumes) in the same
container where free space is available to all volumes in that container (block
device).
●
Allows for clones or multiple copies of the same file, with only changes stored as
deltas, which reduces storage space when making revisions or copying files.
●
Metadata corruption prevention due to creating new records instead of overwriting
existing ones, which can become corrupt due to system crashes.

5
Limitations of APFS

●
Volumes formatted as APFS can't offer share points over the
network using Apple Filing Protocol (AFP).
●
Currently not supported by Fusion Drives.
●
Cannot be used for a Time Machine backup drive (Backup drive
must be HFS+ otherwise it will not work).
●
Encrypted volumes can only be accessible by other computers
running macOS High Sierra.
●
Cannot utilize NVRAM for data storage.
●
APFS is a copy-on-write filesystem so each block is copied before
changes are applied so a history of all unoverwritten files and
filesystem structures exists. This might result in a huge amount
of forensic artefacts.

6
MacOS File System

7
System Directory Structure MacOS
/Applications Self explanatory, this is where your Mac’s applications are kept
/Developer The Developer directory appears only if you have installed Apple’s Developer Tools, and no
surprise, contains developer related tools, documentation, and files.
/Library Shared libraries, files necessary for the operating system to function properly, including settings,
preferences, and other necessities (note: you also have a Libraries folder in your home directory,
which holds files specific to that user).
/Network largely self explanatory, network related devices, servers, libraries, etc
/System System related files, libraries, preferences, critical for the proper function of Mac OS X
/Users All user accounts on the machine and their accompanying unique files, settings, etc. Much like
/home in Linux
/Volumes Mounted devices and volumes, either virtual or real, such as hard disks, CD’s, DVD’s, DMG
mounts, etc
/ Root directory, present on virtually all UNIX based file systems. Parent directory of all other files
/bin Essential common binaries, holds files and programs needed to boot the operating system and run
properly
/etc Machine local system configuration, holds administrative, configuration, and other system files
/dev Device files, all files that represent peripheral devices including keyboards, mice, trackpads, etc
/usr Second major hierarchy, includes subdirectories that contain information, configuration files, and
other essentials used by the operating system
/sbin Essential system binaries, contains utilities for system administration
/tmp Temporary files, caches, etc
8
/var Variable data, contains files whose contents change as the operating system runs
Thank You !