APFS Data Recovery
What is APFS?
APFS, short for Apple File System, is a brand-new filesystem developed by Apple Inc.
to be used on Apple computers starting with MacOS High Sierra. APFS was designed to replace HFS+,
which has been successfully used on Mac computers for the past 30 years.
The first release was in 2017 and since then it is the official filesystem for the MacOS devices.
Symptoms of APFS Filesystem Failure
When inserting, say, an external drive formatted to APFS, you get the message saying that
"the disk inserted was not readable by this computer".
Do not initialize the drive if it stores important information and you are going to recover data from it.
Another symptom is when you do not see your APFS volume on the desktop.
If you launch Disk Utility you see the APFS partition is listed as uninitialized or not mounted.
Trying to run First Aid on it gives you the following:
Somehow or other but you lost access to data stored on the APFS volume and now you are looking for a way to get data back.
APFS Recovery
On the one hand, APFS, unlike the predecessor HFS+, has many built-in mechanisms designed to protect data from loss and damage:
checksumming metadata, copy-on-write, snaphots. On the other hand, slight damage in metadata makes all the volume inaccessible.
One more aspect is that Apple File System is a brand-new filesystem released in 2017 and, therefore,
there are not so many data recovery solutions.
Those few which available are not tested well because there just were not enough APFS recovery cases solved.
Among the recovery solutions for an APFS-formatted storage,
we should distinguish between those that run on Macs and those which need an APFS disk connected to a Windows PC.
Both have their pros and cons.
We offer a Windows-based data recovery solution for an APFS-formatted storage – ReclaiMe File Recovery software.
You need to get the disk out of the Mac, connect it to a Windows PC, and launch the software.
APFS Recovery Specifics
-
APFS is a copy-on-write filesystem that means you can get many copies of data.
Typically, ReclaiMe groups all the previous copies under the Unclassified folders of each APFS volume.
Anyway, when copying files and folders, especially those located under the Unclassified folders,
pay attention to the size of folder ReclaiMe displays so that not to copy excessive amount of data.
-
APFS stores all the metadata closer to the beginning of the storage device;
that's why you get the result very quickly – typically within first 3-5% of the scan.
-
Since APFS was released in 2017, it has not been fully studied yet, you can expect both possible bugs
in APFS recovery algorithms and failures in particular cases which are not covered yet.
If you encounter such a situation, feel free to send a support request at www.ReclaiMe.com.
-
APFS container operates with a single pool of blocks, which are shared between different volumes.
There is a bitmap storing records on which block belongs to which volume.
When deleting or formatting a volume, its blocks are returned to the pool of free blocks and during the recovery
you can get so called orphan data which does not belong to any volume.
In this case, you have to manually associate data with the volumes.
-
Encryption . Unlike HFS+, which in conjunction with FileVault encrypts the entire disk,
APFS encrypts only blocks storing data (or metadata).
In terms of recovery, everything is as usual – if you lose the key, you will not be able to recover data.
-
Snapshots. APFS supports snapshots for volumes onlyrather than for an entire container. When making a snapshot, you create a "canned" state of the volume - blocks with file data belonging at least to one of the snapshots cannot be discarded which is obviously very good when it comes to data recovery.