Before explaining how Mojave's Version 3 APFS handles Fusion Drives, let me remind you how they work in good old HFS +.
We developed different approaches to identify and restore deleted files on an APFS file system and published a paper if they used the methods. In addition, we implemented the open source recovery tool avro that was released three months ago. By using afro, we evaluated and compared the different approaches between each other and the identified method that has so far yielded the best results and compared with photo theory. This showed that AFRO surpasses photo search on the evaluated APFS dataset. In the presentations of this survey, we were often asked if other tools like Blackbags Blacklight did not already support this recovery process. So, we decided to compare the file recovery capabilities of BlackLight and Afro. We wanted to compare afro to sleuth kit as well, as at the DFRWS conference it was discussed to add APFS Support for The Sleuthkit Framework, but no implementations are public yet.
Gregory Szorc (via Peter Steinberger ]):
I'm trying to profiled all the processes on my system when driving Mercurial[…]
test harness. Aggregate thread stacks revealed a regular pattern:
readdir ()is in the stack.
Although the APFS source code is not available for me to confirm,[…]
Profiling results show excessive time spent in
lck_mtx_lock_grab_mutex ()combined with execution time
falls when parallel process count decreases leads me to
Conclusion that APFS achieves a global core lock under read-only
readdir (). In other words, the APFS slows down when
attempting to perform parallel read-only I / O.
It is clear that macOS 10.14 Mojave has received performance work
compared to macOS 10.13! Total core CPU time when performing parallel
Catalog tours have gone significantly – to ~ 50% of original on some
incantations! Stacks seem to reveal new code for lock purchases, so this
may indicate generic improvements to the core locking mechanism
instead of APFS specific changes. Changes in file metadata caching could
Also be responsible for performance changes. Although it's hard to tell
without access to the APFS source code. Despite these improvements, APFS
still consumes a lot of CPU time at the core. And the core CPU time
is still relatively high compared to Linux / EXT4, even for single
Jonathan Levin (PDF, via Objective-See ):
APFS has become the de facto file system for MacOS and iOS as for 10.13 / 10.3- but what do we really know about it? Apple has promised that the specification should be released "later this year" … over two years ago!
Reverse complex file system structures, container blocks, still images and trees are a miserable job, but some have to do it. Jonathan will present the unofficial APFS specification as shown in Volume II of the "* OS Internals" Trilogy, and presents a free tool for inspection and review of APFS partitions and disk images for MacOS, iOS and Linux.
Previous: macOS 10.14 Mojave Released, Apple File System Reference.
Stay updated by subscribing to the RSS feed for this post.