Edmondo's Vault

APFS - What It Is

May 18, 20263 min read

APFS

Recommended reading order

These notes form a learning sequence. Read in this order:

  1. APFS - What It Is (you are here)
  2. APFS - Container and Volume Model
  3. APFS - Copy-on-Write and Clones
  4. APFS - Snapshots
  5. APFS - Purgeable Space
  6. APFS - Firmlinks and the Split Volume Design
  7. APFS - Sealed System Volume (SSV)
  8. macOS Disk Reporting
  9. diskutil - The Ground Truth Tool
  10. Deleted-But-Open Files ← the #1 cause of invisible disk usage
  11. macOS Security - SIP and TCC
  12. Space Consumers - System
  13. Space Consumers - Developer Tools
  14. Space Consumers - VMs and Containers
  15. launchd - The macOS Process Manager
  16. macOS Boot Modes
  17. Diagnostic Playbook - Finding Hidden Space on macOS

APFS (Apple File System) replaced HFS+ in 2017. It was designed from scratch for flash/SSD storage and for the specific needs of Apple’s product line — phones, tablets, watches, and Macs sharing the same filesystem format.

If you know ZFS, APFS will feel familiar in some places and alien in others. If you know ext4 or XFS, almost nothing maps cleanly.

The core design decisions that matter for disk accounting:

  1. It is a copy-on-write (CoW) filesystem. Like ZFS’s ZVOL, no block is ever modified in place. A write always allocates a new block, writes there, then updates the metadata tree to point to it. The old block is freed only when no snapshot or clone references it anymore. This is what makes snapshots and clones cheap to create — but it’s also why disk accounting becomes non-trivial.

  2. Multiple volumes share a single storage pool. There is no partitioning of space between volumes at creation time. All volumes draw from the same free pool. This is the biggest conceptual departure from traditional filesystems. See APFS - Container and Volume Model.

  3. It has a native snapshot mechanism. Snapshots are first-class filesystem objects, not a bolt-on. They are efficient but they silently retain blocks that look “deleted” from your perspective. See APFS - Snapshots.

  4. It has a concept of purgeable space. Some blocks are allocated, contain valid data, but are marked as eligible for automatic eviction without data loss. These blocks show as “used” in some tools and “available” in others. See APFS - Purgeable Space.

  5. On macOS specifically, APFS implements a split read-only/read-write OS design via a mechanism called firmlinks (a kernel-level path redirection that is neither a symlink nor a bind mount). See APFS - Firmlinks and the Split Volume Design and APFS - Sealed System Volume (SSV).

See also

Graph View

Backlinks