Skip to content

Tagged: #apfs

← Back to all articles
Time Machine on APFS: snapshots, network backups, and rollback
How Time Machine uses APFS snapshots for local backups, the per-hour/per-day/per-week retention policy, and what rollback actually does to your filesystem.
apfstime-machinesnapshotbackup
APFS encryption: FileVault, per-file keys, and the SEP's role
How macOS encrypts every byte on disk — per-file keys derived in the SEP, the volume encryption key wrapped by user password, hardware AES in the SSD controller.
apfsencryptionfilevaultsep
Inside the APFS object map: how the filesystem b-tree works
Every block on an APFS volume is reachable through one b-tree — the object map. Here's how it's laid out, how it survives a write, and why APFS is self-checksumming by design.
apfsbtreecheckpointfilesystem
APFS clones and snapshots: the kernel calls that make them work
clonefile, fclonefileat, fs_snapshot — three syscalls that let you copy 50 GB in 50 milliseconds. Here's what happens under each one, and what doesn't get copied.
apfsfilesystemclonefilesnapshots
Inside APFS: copy-on-write, snapshots, and the sealed system volume
Apple File System, the format under every modern Mac: how it lays out blocks, how it gets snapshots almost for free, and why your /System is read-only at the cryptographic level.
apfsfilesystemkernelxnu