Adding APFS Support to The Sleuthkit Framework
Joe Sylve discusses his work at DFRWS USA 2018: …
The Most Essential Image Data Retrieval for Digital Forensic Experts
This article is a general explanation why and how forensic experts and first responders could benefit from a tool that provi…
libfsapfs: Library and Tools to Access the Apple File System (APFS)
libfsapfs is a library and tools by Joachim Metz to access the Apple File System (APFS). Source code is available at GitHub.…
The Challenges of APFS and How EnCase Can Help
The new Apple File System (APFS) was developed to replace HFS+ and became the default file system in September 2017. Like ma…
afro (APFS file recovery)
afro can parse APFS images. It not only extracts the latest data but also older versions of the files. Learn more about the …
Epochalypse: Utility to Convert Epoch Timestamps
Epochalypse utility by Pasquale Stirparo has been updated. Now it supports APFS timestamps. You can download this Python scr…
Parsing APFS with Magnet AXIOM
Despite the fact APFS isn’t currently supported by AXIOM, the author of “The Swanepoel Method” blog ran a …
Apple File System (APFS) – Acquisition, Decryption and Analysis
During this webinar BlackBag Technologies representatives will show you how to acquire, decrypt and analyze APFS volumes: …
Getting Saucy with APFS
Sarah Edwards has published her presentation (PDF) and demo videos from BSides Baltimore. You will learn about how to acquir…
Mounting an APFS image in Linux
Here is another post by Another Forensics Blog (Mari Degrazia) about mounting Apple File System (APFS). This time you will l…
