13 ms·

APFS filesystem format

330 points by mkup 9y ago

twoodfin 9y ago
Does anyone know or can speculate on the purpose of the 4 "alignment" bytes in the node block header? Are they for alignment (in which case it's strange to have them at the beginning instead of the end)? Or are they describing alignment (in which case it's strange to need 32 bits)?
- cugu 9y ago
  I just called it alignment. It's just a bit that decides wether the following entries are fixed length or variable length.
tradersam 9y ago
Ends a little abruptly (as in no closing) but other than that interesting read.
- mbell 9y ago
  It's a description of the format, not a review of it. What conclusion were you after?
  - tradersam 9y ago
    Fair point! I looked at it more of a blog post, but I suppose I should've looked at it more as a resource. My mistake.
  - johnpowell 9y ago
    I wasn't even after a conclusion or anything. But since there isn't a footer I just thought maybe my internet connection died and it only loaded a portion of the page.
tomsmeding 9y ago
Awesome research, would love to be able to do that. Some things that came to mind: I like that some of the block types are "acronyms" of their meanings: 5 = S(pace man), B = B(-tree), C = C(heckpoint). Also, I wonder why the volume superblock magic is "APSB", while the root (container) magic is "NXSB"; maybe this refers to NextStep? Seems a bit anachronistic, but I don't know.
- kstenerud 9y ago
  Apple superblock, and next superblock (meaning "the next superblock", not nextstep).
- cugu 9y ago
  It's not hard to do, it just takes some time ;) I realized B = B-tree and C = Checkpoint, but I missed 5 = Spaceman. Good idea!
karmicthreat 9y ago
Kaitai which was used as a parser for this looks pretty interesting. I need to reverse engineer some of the Allen Bradley Ethernet Industrial Protocol and its client communication. This seems pretty useful for documenting that.
- contingencies 9y ago
  http://kaitai.io/ http://kaitai.io/ Also check out https://ohmlang.github.io/ https://ohmlang.github.io/ and view the maths demo in your local copy.
  - karlshea 9y ago
    Holy shit this is so cool. I will never have a need for this but it's really amazing to poke around with. It kind of feels like Wireshark for files instead of packets. They also have a web version[0] with a bunch of example files if you want to check it out without installing it locally. [0] https://ide.kaitai.io/ https://ide.kaitai.io/
fasterthanlime 9y ago
Typo thread! "this hight result in" => "might" "and seams to be related" => "seems" "sometimes spaceman" => "sometimes called spaceman" ? Very interesting read, thanks!
xoa 9y ago
Very, very cool exercise. For anyone who hasn't been following APFS much though, worth knowing that Apple has stated in their AFPS FAQ [1] that they do intend to directly "document and publish the APFS volume format specification" themselves later this year. Presumably (as they do with other stuff they develop) they want to be able to more easily make breaking changes during the shakedown period of initial public deployment (first on iOS right now, later on Macs, though maybe not a default option until 10.13 this Summer/Fall). That'd be the most helpful in getting read/write into FUSE and other platforms should anyone choose to do so. --- 1. https://developer.apple.com/library/content/documentation/FileManagement/Conceptual/APFS_Guide/FAQ/FAQ.html https://developer.apple.com/library/content/documentation/Fi...
- avar 9y ago
  They said the same about Facetime and iMessages but never opened or documented those, so let's see when and if it actually happens. Apple has a history of false promises when it comes to opening and documenting their protocols & data formats. Edit: I misrecalled that iMessage was announced as something they were opening.
  - scarface74 9y ago
    They never promised to open up iMessage. The story behind FaceTime is a little bit more complicated. Steve Jobs said he would open it up without asking the engineers and lawyers who were just as surprised as anyone else about his announcement. As far as Apple not open sourcing anything. https://opensource.apple.com https://opensource.apple.com They also published the full git commit history of Swift from the initial commit.
    - erik 9y ago
      Specifically, there were major lawsuits over patent infringement immediately after Facetime launched.
      - twoodfin 9y ago
jdmnd 9y ago
Timestamps are 64bit nanoseconds As far as I can tell, this will overflow in just 11 years – 2028-06-15 09:33:27.3709551615 UTC Why would this go into a new standard? Is there a practical use for such a high level of granularity? edit: off by a factor of 10 in my calculation... It's actually 2554-07-21 23:34:33.709551615 UTC
- DuskStar 9y ago
  2^64 nanoseconds is ~584 years, though.
- raldi 9y ago
  By my math, we're fine for almost 600 years: http://wolframalpha.com/input/?i=2%5E64+nanoseconds+from+now&x=0&y=0 http://wolframalpha.com/input/?i=2%5E64+nanoseconds+from+now...
  - cimnine 9y ago
    But that should be 'from 1.1.1970', i.e. from the unix epoch. Still far out, though.
- twoodfin 9y ago
  2^64 nanoseconds is > 580 years. Even cutting it in half for signed values is still likely 10X the expected lifetime of this particular iteration of APFS. The granularity is probably useful for establishing an ordering (even somewhat arbitrarily) for highly concurrent file system operations, and thus potentially skipping a bunch of expensive synchronization.
  - jsjohnst 9y ago
    As mentioned in the article, they are unsigned 64bit integers though.
    - cugu 9y ago
      Don't take anything in the article as completely proven. There are some guesses in there.
xaduha 9y ago
Is there any reason to use APFS on desktop?
- kentor 9y ago
  I heard there will be copy-on-write for files. For web devs this would save a lot of space and time when copying files from yarn cache to node_modules.
  - collinmanderson 9y ago
    I wonder what it means for appending data to a large log file. Does the entire log file need to get copied on every write (or just a block of the file?)
- sargun 9y ago
  There are a couple features missing from HFS+. Some of these are implemented in APFS: * Case sensitivity * Clones extents / ranges (reflinking) * Holes in the middle of files * ACLs * Collapsing file ranges * Per file compression and per file encryption These are useful for apps like SQLite or other stores which implement a multi user, log structured store.
  - yjftsjthsd-h 9y ago
    Isn't there a flag to make hfs case sensitive? Programs react poorly because it's rare, but it's available.
  - mrmondo 9y ago
    FYI - HFS is capability of case sensitivity and is an option during formatting. I believe it even used to be the default.
    - duskwuff 9y ago
      HFS and HFS+ were never case-sensitive by default on Mac OS. Case-sensitive HFS+ was made available as an option in Mac OS 10.0, but was always glitchy (especially for boot volumes), because many applications depended on case insensitivity.
mandeepj 9y ago
If someone wants to know like me why Apple came up with a whole new FS - http://www.cultofmac.com/435718/apfs-new-apple-file-system/ http://www.cultofmac.com/435718/apfs-new-apple-file-system/
- ianopolous 9y ago
  Great link! I'm very interested in the mention of per file keys, one for data and one for metadata. I wonder what data structure they store these in. It sounds a lot like cryptree [0]. [0] https://raw.githubusercontent.com/ianopolous/Peergos/master/papers/wuala-cryptree.pdf https://raw.githubusercontent.com/ianopolous/Peergos/master/...
gigatexal 9y ago
So it is copy-on-write. Interesting.
Ben2Wilson 9y ago
I want to publicly thank Binaryreap3r for their professional hacking service. Which I'm happy to recommend to you. Has your Social account been attacked by a hacker? Do you need to get back into your Facebook, Twitter, Instagram or Google+ account?, Have you lost your email or social media password and want to crack/recover it from computers?. Are you being cyber stalked and wish to find the source and stop the cyber predator?, Have you been scammed online? Do you need to locate and report the perpetrator?. Do you want to encrypt your data and protect your sensitive informations?. Any social engineering problem you may have. I know a white hat hacker that delivers!. He helped out with an issue and I think he's good what he does. Contact binaryreap3r@gmail.com or text +16155497267 for all yoiur professional hacking needs.
mappu 9y ago
Is there a filesystem that can fragment a large, existing file to perform arbitrary inserts?
- tyingq 9y ago
  Common in the mainframe world, like VSAM. That would be variable length record oriented files, versus stream files. Someone did do this for GEOS: http://justsolve.archiveteam.org/wiki/GEOS_VLIR http://justsolve.archiveteam.org/wiki/GEOS_VLIR , but I've never seen that for anything remotely unix like.
- duskwuff 9y ago
  Unlikely. It's difficult to implement, and can be worked around by applications that need it.
- koverstreet 9y ago
  fallocate(FL_INSERT_RANGE) can do that, but only on block boundaries
israrkhan 9y ago
Apple should publish something like TN1150 for APFS. several years ago, I had to implement HFS+ for an embedded system, and TN1150 proved very helpful, saved me a lot of hassle. https://developer.apple.com/legacy/library/technotes/tn/tn1150.html https://developer.apple.com/legacy/library/technotes/tn/tn11...
wolfgang42 9y ago
For those who, like me, don't follow developments in this area closely: APFS is Apple's new filesystem, intended to be used across all of their devices (Macs, iOS, watchOS, etc). For Macs, it will be replacing HFS+, a direct descendant of the Hierarchical Filing System which has been used since 1985. (The original Macintosh Filing System, from 1984, was suitable only for floppy disks; among other things, it was a flat filing system and didn't really support folders.) The main improvements HFS+ made over HFS were support for larger files and Unicode; Apple has since added some more features but the core filesystem remains a 30-year-old format which was designed for early hard disks.
- twoodfin 9y ago
  It replaced (as of iOS 10.3) HFS+ on the mobile devices as well, didn't it?
  - Tanegashima 9y ago
    Yes.
  - agildehaus 9y ago
    Almost correct. 32-bit devices that received iOS 10.3 did not receive APFS. It was exclusively delivered to 64-bit devices.
    - orbitur 9y ago
      It's also worth noting that the first 64-bit iPhone/iPad were released in 2013, so they've been around for a while. The iPhone 5c will have the shortest support window from its release, at 4 years.
- joelthelion 9y ago
  So what features does the new filesystem bring?
  - masklinn 9y ago
Tanegashima 9y ago
Look, we get it, you bought an Android and you want to use iMessage and FaceTime. That would be stupid, Apple doesn't make money from users data, Apple doesn't listen to conversations like Google does to sell ads. So why would they support servers (and there are a lot more of android users than iOS users) for people that didn't bought anything from them? For people that bought Androids to like them? They don't need that. It has nothing to do with open source, the open source community doesn't need this and Apple couldn't care less about the GNU types after GPLv3 incompatibilizes with their business (while Android OEMs break the license every single day, but the community turns a blind eye, because it's Google) Also, they would lose a few of their product sales and lots of 30% shares on sticker packs and other Apps for iMessage they sell.
- tyingq 9y ago
  That's not at all why I posted this or where I was going. I do happen to have an Android, but don't use apps other than a web browser and whatever the SMS app is. I have no desire to video chat, or any need for SMS beyond what a Nokia can do. I am just interested in knowing more about why Apple has the reputation it does around open source. The thread has delivered on that. Also delivered on the idea that apple fans are oddly defensive. Honestly not trolling, but the reaction seems as if I did succeed in that somehow.
- dang 9y ago
  We detached this subthread from https://news.ycombinator.com/item?id=14175206 https://news.ycombinator.com/item?id=14175206 and marked it off-topic.
sandGorgon 9y ago
Anyone know how Apple pulled off an in place filesystem upgrade ? Is the data copied to your upgrade laptop and back ?
- djrogers 9y ago
  No, nothing like that necessary. Data remains in the same spot, and during the conversion new metadata and file tables/pointers are created in APFS format. Then the volume is remounted using the new format, and the old hfs stuff goes bye-bye.

330 points by mkup 9y ago

Does anyone know or can speculate on the purpose of the 4 "alignment" bytes in the node block header? Are they for alignment (in which case it's strange to have them at the beginning instead of the end)? Or are they describing alignment (in which case it's strange to need 32 bits)?

cugu 9y ago
I just called it alignment. It's just a bit that decides wether the following entries are fixed length or variable length.

tradersam 9y ago

Ends a little abruptly (as in no closing) but other than that interesting read.

mbell 9y ago
It's a description of the format, not a review of it. What conclusion were you after?
- tradersam 9y ago
  Fair point! I looked at it more of a blog post, but I suppose I should've looked at it more as a resource. My mistake.
- johnpowell 9y ago
  I wasn't even after a conclusion or anything. But since there isn't a footer I just thought maybe my internet connection died and it only loaded a portion of the page.

tomsmeding 9y ago

Awesome research, would love to be able to do that. Some things that came to mind: I like that some of the block types are "acronyms" of their meanings: 5 = S(pace man), B = B(-tree), C = C(heckpoint). Also, I wonder why the volume superblock magic is "APSB", while the root (container) magic is "NXSB"; maybe this refers to NextStep? Seems a bit anachronistic, but I don't know.

kstenerud 9y ago
Apple superblock, and next superblock (meaning "the next superblock", not nextstep).
cugu 9y ago
It's not hard to do, it just takes some time ;) I realized B = B-tree and C = Checkpoint, but I missed 5 = Spaceman. Good idea!

karmicthreat 9y ago

Kaitai which was used as a parser for this looks pretty interesting. I need to reverse engineer some of the Allen Bradley Ethernet Industrial Protocol and its client communication. This seems pretty useful for documenting that.

contingencies 9y ago
http://kaitai.io/ http://kaitai.io/ Also check out https://ohmlang.github.io/ https://ohmlang.github.io/ and view the maths demo in your local copy.
- karlshea 9y ago
  Holy shit this is so cool. I will never have a need for this but it's really amazing to poke around with. It kind of feels like Wireshark for files instead of packets. They also have a web version[0] with a bunch of example files if you want to check it out without installing it locally. [0] https://ide.kaitai.io/ https://ide.kaitai.io/

fasterthanlime 9y ago

Typo thread! "this hight result in" => "might" "and seams to be related" => "seems" "sometimes spaceman" => "sometimes called spaceman" ? Very interesting read, thanks!

xoa 9y ago

Very, very cool exercise. For anyone who hasn't been following APFS much though, worth knowing that Apple has stated in their AFPS FAQ [1] that they do intend to directly "document and publish the APFS volume format specification" themselves later this year. Presumably (as they do with other stuff they develop) they want to be able to more easily make breaking changes during the shakedown period of initial public deployment (first on iOS right now, later on Macs, though maybe not a default option until 10.13 this Summer/Fall). That'd be the most helpful in getting read/write into FUSE and other platforms should anyone choose to do so. --- 1. https://developer.apple.com/library/content/documentation/FileManagement/Conceptual/APFS_Guide/FAQ/FAQ.html https://developer.apple.com/library/content/documentation/Fi...

avar 9y ago
They said the same about Facetime and iMessages but never opened or documented those, so let's see when and if it actually happens. Apple has a history of false promises when it comes to opening and documenting their protocols & data formats. Edit: I misrecalled that iMessage was announced as something they were opening.
- scarface74 9y ago
  They never promised to open up iMessage. The story behind FaceTime is a little bit more complicated. Steve Jobs said he would open it up without asking the engineers and lawyers who were just as surprised as anyone else about his announcement. As far as Apple not open sourcing anything. https://opensource.apple.com https://opensource.apple.com They also published the full git commit history of Swift from the initial commit.
  - erik 9y ago
    Specifically, there were major lawsuits over patent infringement immediately after Facetime launched.
    - twoodfin 9y ago

jdmnd 9y ago

Timestamps are 64bit nanoseconds As far as I can tell, this will overflow in just 11 years – 2028-06-15 09:33:27.3709551615 UTC Why would this go into a new standard? Is there a practical use for such a high level of granularity? edit: off by a factor of 10 in my calculation... It's actually 2554-07-21 23:34:33.709551615 UTC

DuskStar 9y ago
2^64 nanoseconds is ~584 years, though.
raldi 9y ago
By my math, we're fine for almost 600 years: http://wolframalpha.com/input/?i=2%5E64+nanoseconds+from+now&x=0&y=0 http://wolframalpha.com/input/?i=2%5E64+nanoseconds+from+now...
- cimnine 9y ago
  But that should be 'from 1.1.1970', i.e. from the unix epoch. Still far out, though.
twoodfin 9y ago
2^64 nanoseconds is > 580 years. Even cutting it in half for signed values is still likely 10X the expected lifetime of this particular iteration of APFS. The granularity is probably useful for establishing an ordering (even somewhat arbitrarily) for highly concurrent file system operations, and thus potentially skipping a bunch of expensive synchronization.
- jsjohnst 9y ago
  As mentioned in the article, they are unsigned 64bit integers though.
  - cugu 9y ago
    Don't take anything in the article as completely proven. There are some guesses in there.

xaduha 9y ago

Is there any reason to use APFS on desktop?

kentor 9y ago
I heard there will be copy-on-write for files. For web devs this would save a lot of space and time when copying files from yarn cache to node_modules.
- collinmanderson 9y ago
  I wonder what it means for appending data to a large log file. Does the entire log file need to get copied on every write (or just a block of the file?)
sargun 9y ago
There are a couple features missing from HFS+. Some of these are implemented in APFS: * Case sensitivity * Clones extents / ranges (reflinking) * Holes in the middle of files * ACLs * Collapsing file ranges * Per file compression and per file encryption These are useful for apps like SQLite or other stores which implement a multi user, log structured store.
- yjftsjthsd-h 9y ago
  Isn't there a flag to make hfs case sensitive? Programs react poorly because it's rare, but it's available.
- mrmondo 9y ago
  FYI - HFS is capability of case sensitivity and is an option during formatting. I believe it even used to be the default.
  - duskwuff 9y ago
    HFS and HFS+ were never case-sensitive by default on Mac OS. Case-sensitive HFS+ was made available as an option in Mac OS 10.0, but was always glitchy (especially for boot volumes), because many applications depended on case insensitivity.

mandeepj 9y ago

If someone wants to know like me why Apple came up with a whole new FS - http://www.cultofmac.com/435718/apfs-new-apple-file-system/ http://www.cultofmac.com/435718/apfs-new-apple-file-system/

ianopolous 9y ago
Great link! I'm very interested in the mention of per file keys, one for data and one for metadata. I wonder what data structure they store these in. It sounds a lot like cryptree [0]. [0] https://raw.githubusercontent.com/ianopolous/Peergos/master/papers/wuala-cryptree.pdf https://raw.githubusercontent.com/ianopolous/Peergos/master/...

gigatexal 9y ago

So it is copy-on-write. Interesting.

Ben2Wilson 9y ago

I want to publicly thank Binaryreap3r for their professional hacking service. Which I'm happy to recommend to you. Has your Social account been attacked by a hacker? Do you need to get back into your Facebook, Twitter, Instagram or Google+ account?, Have you lost your email or social media password and want to crack/recover it from computers?. Are you being cyber stalked and wish to find the source and stop the cyber predator?, Have you been scammed online? Do you need to locate and report the perpetrator?. Do you want to encrypt your data and protect your sensitive informations?. Any social engineering problem you may have. I know a white hat hacker that delivers!. He helped out with an issue and I think he's good what he does. Contact binaryreap3r@gmail.com or text +16155497267 for all yoiur professional hacking needs.

mappu 9y ago

Is there a filesystem that can fragment a large, existing file to perform arbitrary inserts?

tyingq 9y ago
Common in the mainframe world, like VSAM. That would be variable length record oriented files, versus stream files. Someone did do this for GEOS: http://justsolve.archiveteam.org/wiki/GEOS_VLIR http://justsolve.archiveteam.org/wiki/GEOS_VLIR , but I've never seen that for anything remotely unix like.
duskwuff 9y ago
Unlikely. It's difficult to implement, and can be worked around by applications that need it.
koverstreet 9y ago
fallocate(FL_INSERT_RANGE) can do that, but only on block boundaries

israrkhan 9y ago

Apple should publish something like TN1150 for APFS. several years ago, I had to implement HFS+ for an embedded system, and TN1150 proved very helpful, saved me a lot of hassle. https://developer.apple.com/legacy/library/technotes/tn/tn1150.html https://developer.apple.com/legacy/library/technotes/tn/tn11...

wolfgang42 9y ago

For those who, like me, don't follow developments in this area closely: APFS is Apple's new filesystem, intended to be used across all of their devices (Macs, iOS, watchOS, etc). For Macs, it will be replacing HFS+, a direct descendant of the Hierarchical Filing System which has been used since 1985. (The original Macintosh Filing System, from 1984, was suitable only for floppy disks; among other things, it was a flat filing system and didn't really support folders.) The main improvements HFS+ made over HFS were support for larger files and Unicode; Apple has since added some more features but the core filesystem remains a 30-year-old format which was designed for early hard disks.

twoodfin 9y ago
It replaced (as of iOS 10.3) HFS+ on the mobile devices as well, didn't it?
- Tanegashima 9y ago
  Yes.
- agildehaus 9y ago
  Almost correct. 32-bit devices that received iOS 10.3 did not receive APFS. It was exclusively delivered to 64-bit devices.
  - orbitur 9y ago
    It's also worth noting that the first 64-bit iPhone/iPad were released in 2013, so they've been around for a while. The iPhone 5c will have the shortest support window from its release, at 4 years.
joelthelion 9y ago
So what features does the new filesystem bring?
- masklinn 9y ago

Tanegashima 9y ago

Look, we get it, you bought an Android and you want to use iMessage and FaceTime. That would be stupid, Apple doesn't make money from users data, Apple doesn't listen to conversations like Google does to sell ads. So why would they support servers (and there are a lot more of android users than iOS users) for people that didn't bought anything from them? For people that bought Androids to like them? They don't need that. It has nothing to do with open source, the open source community doesn't need this and Apple couldn't care less about the GNU types after GPLv3 incompatibilizes with their business (while Android OEMs break the license every single day, but the community turns a blind eye, because it's Google) Also, they would lose a few of their product sales and lots of 30% shares on sticker packs and other Apps for iMessage they sell.

tyingq 9y ago
That's not at all why I posted this or where I was going. I do happen to have an Android, but don't use apps other than a web browser and whatever the SMS app is. I have no desire to video chat, or any need for SMS beyond what a Nokia can do. I am just interested in knowing more about why Apple has the reputation it does around open source. The thread has delivered on that. Also delivered on the idea that apple fans are oddly defensive. Honestly not trolling, but the reaction seems as if I did succeed in that somehow.
dang 9y ago
We detached this subthread from https://news.ycombinator.com/item?id=14175206 https://news.ycombinator.com/item?id=14175206 and marked it off-topic.

sandGorgon 9y ago

Anyone know how Apple pulled off an in place filesystem upgrade ? Is the data copied to your upgrade laptop and back ?

djrogers 9y ago
No, nothing like that necessary. Data remains in the same spot, and during the conversion new metadata and file tables/pointers are created in APFS format. Then the volume is remounted using the new format, and the old hfs stuff goes bye-bye.