ApFS (stands for Apple File System) is a file system developed by Apple for the new iOS, macOS, tvOS, and watchOS, and is not an add-on or add-on to HFS +. HFS + components: log, distribution file, catalog file, extent overflow file, attribute file have been completely removed from ApFS. This is a revised FS, it uses a different structure and a new data protection policy.
According to the developers, it is optimized as much as possible for SSD and Flash drives. And also, received several nice features: new encryption algorithms, protection against failures, "smart" use of disk space and the function of cloning information. All this provides an increased speed of reading / writing information, stability of the operating system and protection of user data. In practice, additional protection has appeared, but it is not enough.
Recovery algorithm
The ApFS feature is a new read / write algorithm, each single block of data is copied before saving to disk or confirming file changes. That is, the file system stores the "history of changes" of all files, and this allows you to find a large number of structural data blocks of a file, its "pieces".
The minimum data block size that ApFS processes in this way is 4096 bytes. When found, they are "read", the metadata is found, and then it is used to extract the files themselves.
ApFS supports Apple operating systems from High Sierra or newer. If Windows is installed, then additional software is required to access the FS. ApFS data recovery utilities natively recognize this file system, so you don't need to install anything else.
Let's start testing
On a PC with OS Catalina, several containers with partitions were created, then "run" by recovery programs and collected the results, which are presented below.
For the tests, the most common programs were chosen:
- Hetman Partition Recovery
- R-studio
- Easeus Data Recovery Wizard
- Disk Drill
- Recuva.
But Disk Drill and Recuva were excluded from the tests, as they lack ApFS support at all. While this is to be expected from Recuva, Disk Drill was unpleasantly surprised as it is the standard for data recovery from Mac devices. Photo and video files were uploaded to the test drive, and then some of them were deleted.
All tests were carried out on a PC running Windows 10.
Hetman Partition Recovery Test
The utility immediately correctly identified the drive with ApFS. After the standard file deletion, it will be enough to carry out a quick scan, which does not take much time, and the result will appear very quickly.
The program found both existing and deleted files with a red cross on the icons. You can view a preview of all files, the directory structure is completely saved, you just need to select the files and click on the "Restore" button.
R-studio test
R-studio also recognized the test disk, we are doing a quick scan of the partition, and the program was unable to display the deleted files.
We have to carry out a complete analysis, it takes much more time, but the result is good. R-studio found all the necessary files and saved the directory structure, a preview of the deleted data is also available.
Easeus test
The utility from Easeus also correctly identified the test drive, but only the size is displayed correctly, the file system type and disk name are not displayed in the application. Fast scanning is not provided in this program, therefore we run a full scan.
In the results, the disk structure and file names are not saved, the files are sorted into directories by type. The deleted data is not marked in any way. I had to figure it out manually by recalculating the files in the directories.
Otherwise, it is possible to view a preview of all files, so that they can be restored without problems.
As you can see from the tests, all programs did an excellent job with the task, there are minor inconveniences associated with file names and directory structure.
Removed container superblock
Now let's complicate the task. we will specially overwrite the container superblock on the test drive, which is located in the first two sectors. We erase the skperblock data using a HEX editor and try to recover the data.
Hetman Partition Recovery
The program from Hetman immediately detected the medium, indicated the correct size, but the file system was not recognized.
Now you can't find anything with a quick scan, we carry out a full analysis, it takes much more time. As a result, the utility recognizes the file system and disk name.
Partition Recovery retained the disk structure and file names, but marked all data as “deleted”. The program can show previews of files, that is, it coped with the second test, albeit for a longer time.
R-studio test
The R-studio utility displayed the correct disk space, but the file system was not defined.
We run a full scan, the program found ApFS, the directory structure, file names are saved, that is, the program also passed the second test well.
Easeus Challenge
Easeus found the volume correctly, but the file system is not defined.
We start scanning, the program produced the same result as in the first test. All information has been found, a preview is available for each file, the structure has not been preserved. The Easeus utility did an excellent job as well.
Thus, all three programs have shown the same successful results.
Deleted volumes, APFS internal disk information.
Now is the time for a real serious test. In addition to the superblock, information about internal partitions - "volum" (volumes) will be erased.
Hetman Partition Recovery Test
The disk capacity was detected correctly, the name and file system are not displayed.
We run the full analysis, the results are the same as in the previous test: a preview is available for all files, therefore they can be restored. The program did an excellent job.
Checking R-studio
R-studio also recognized the disc correctly, file system and name were not found.
After a full scan, a full preview of all files is also available, hence the utility did the job just as well.
Easeus check
Easeus also found the media, correctly indicated the volume, no name and FS.
We carry out a full analysis, Easeus found all the information, the preview function also shows each file, therefore, the program passed the test. The only thing to make sure that all the data is found, the files have to be recalculated every time.
I asked for this test all the programs without any complaints.
Removed container map
In this task, on the test disk, the container card was additionally removed, that is, the drive does not have: superblock, volums, container cards and volum cards.
Hetman Partition Recovery Test
The program has detected the disk and volume, the file system is not recognized. After a complete analysis, all files are found, the structure is saved, a preview is available, that is, all information can be restored.
R-studio test
The program saw the disk, but the file system was not found. After full analysis, the scan wizard was unable to locate the file system on the disk. test disk could not be found.
After deleting the container object map and volume map, the program simply cannot find the information on the disk. The utility displayed a message about the absence of a file system on the media, and therefore did not cope with the task.
Easeus test
The Easeus utility also detected the drive, the file system was not recognized. After a complete analysis, the program showed the same results as in the previous test.
Easeus always uses signature search, with a large disk size, such a search always takes a long time, the directory structure and file names are lost. But still, the utility coped with the task.
See the source for the full article with all additional video tutorials .