Skip to content

Subsystem · The on-disk format

APFS

Apple File System: copy-on-write, snapshots, cloning, sealed system volumes — the format under every modern Mac.

apple-oss-distributions/xnubsd/vfs/vfs_syscalls.cStart reading the kernel source here.View on GitHub(line —)
APFS container layoutOne APFS container per partition holds multiple volumes that share a single free-space pool. The system volume is read-only and cryptographically sealed; the data volume is writable, joined to the system volume by firmlinks.PHYSICAL DISKSSD (single block device)APFS containersingle shared free-space poolMacintosh HDsystem · sealed · read-only⛨ SSV root hashMacintosh HD - Datauser data · read/writePrebootboot policyRecoveryrecovery OSVMswap filesfirmlink — joins read-only system + writable data into one logical /df reports the same free space for every volume — because there is only one pool.Every write goes to a fresh block. Snapshots are free — they just pin old blocks against GC.
APFS: structure at a glance.

Articles in this series

Inside APFS: copy-on-write, snapshots, and the sealed system volume
Apple File System, the format under every modern Mac: how it lays out blocks, how it gets snapshots almost for free, and why your /System is read-only at the cryptographic level.
apfsfilesystemkernelxnu
APFS clones and snapshots: the kernel calls that make them work
clonefile, fclonefileat, fs_snapshot — three syscalls that let you copy 50 GB in 50 milliseconds. Here's what happens under each one, and what doesn't get copied.
apfsfilesystemclonefilesnapshots
APFS encryption: FileVault, per-file keys, and the SEP's role
How macOS encrypts every byte on disk — per-file keys derived in the SEP, the volume encryption key wrapped by user password, hardware AES in the SSD controller.
apfsencryptionfilevaultsep
Inside the APFS object map: how the filesystem b-tree works
Every block on an APFS volume is reachable through one b-tree — the object map. Here's how it's laid out, how it survives a write, and why APFS is self-checksumming by design.
apfsbtreecheckpointfilesystem
Time Machine on APFS: snapshots, network backups, and rollback
How Time Machine uses APFS snapshots for local backups, the per-hour/per-day/per-week retention policy, and what rollback actually does to your filesystem.
apfstime-machinesnapshotbackup