 Hello everybody! In today's video, we will discuss APFS file system, explorate structure and the changes that distinguish it from the previous version HFS+. We will also analyze data recovery from an APFS drive in terms of peculiarities and possible issues. Finally, we will compare performance and efficiency of different products in recovering data from APFS volumes. Hello friends! If you need to recover deleted data, view or restore remote browser history. Admin software products will help you. Follow the link in the description, download the necessary program for free, install it and analyze the disk. The utility will show you the data you can recover, so you will be able to view it or get it back. In our channel and blog, you will find solutions to any problem, from installing an operating system or configuring it to fixing possible bugs and errors or optimizing mobile gadgets. Our specialists will answer any questions you ask in your comments under the videos or articles. All modern devices with iOS and macOS are using the new way to arrange their files – Apple File System or APFS for short. Instead of further improving the obsolete HFS+, that has developed a number of auxiliary elements and had limited memory options, Apple engineers designed the new file system – APFS. It has an ample space for further development in the future and for the present moment it is the perfect choice for current devices. As we know, this file system has been optimized for flash drives and SSDs. The many innovations in this operating system are improved encryption algorithms, optimized memory usage, crash protection, cloning of files and folders, and smart sparrows usage patterns. In practice, it means stable operation, increased read-write speeds, and more protection for user data. But what if crash protection didn't work and some data was lost? In today's video, we will examine in detail how data recovery from APFS file system works and we'll be doing it with Hetman Partition Recovery running on Windows. Also, we will run a benchmark assessment on how various data recovery tools work with APFS disks. Meanwhile, let's find out what kind of file system it is, why it replaced HFS+, and what are the main differences between the two. HFS+, came into usage in the late 1990s and was soon outdated, as it was only an improved version of HFS. It made simple operations too long and didn't use the device memory efficiently. To solve these and other issues, the new APFS system was designed. It introduced considerable changes in comparison with the predecessor. Thanks to the new functions such as cloning, copying a file or directory instantly which doesn't require additional disk space to store data, and compression, which helps to save disk space and increase write speed, the overall system performance has improved. Now applications can open faster and the overall system response time has improved. Thanks to using snapshots, pointing time, read-only instances of the file system, backup operations take considerably less time. Now the operating system can use snapshots to make backups more efficient and have time machine work faster. Unlike HFS+, based on 32-bit architecture, APFS supports 64-bit structure. In simple words, APFS can store a lot more files than HFS+. About 9 quintillion files in every volume, which must be more than enough for a dozen of years. In addition to faster and stable operation, users will gain access to secure disk encryption tools. Many files can be protected with one or several keys. With a space sharing feature, all volumes of a disk can share their free space. For example, if a volume has insufficient space to accommodate a file, it will use some space from another volume automatically. The developers say it will help the operating system avoid crashes, copy files faster and optimize disk space. One more advantage is quick copying, which is also saving disk space. Now clones are created, but they take as much space as required for one file instead of the two. If there are any changes made to the clone, only changed data is written to disk, while the rest of the file is based on its original version. This simple algorithm helps to save disk space considerably. Improved work with removable devices lets user transfer and read information much faster, which reduces the number of possible write errors. In APFS, the accuracy of timestamps has improved considerably, now it supports timestamping accurate to the nanosecond, while HFS Plus was limited by a second timestamp resolution. APFS uses the copy-on-write principle to guarantee that all changes and interest to the journal will get synchronized all the time, and if the operating system crashes unexpectedly or there is a power off, nothing at all is going to happen to the data in your disks. It applies both to desktop, macOS and mobile iOS platforms. Thanks to APFS, iPhone will no longer get bricked if something goes wrong with another update. APFS is based on a new architecture concept. One of the many features in APFS is the ability to dynamically change the volume size at the expense of another volume. Here is how the file system is designed. There is a disk where the operating system creates a container. This container holds one or more partitions or volumes, each of them having its own structure for storing data, links to file and folder locations, a root directory containing data, files and folders. The structure of such file system is that of a B3, where the root directory containing data is the leaf of such tree. All branch nodes only contain links to the following node until they reach the leaf nodes. Let's compare it with this predecessor, HFS+. If you divided a disk into one or several volumes, this file system assigned a fixed size to every volume, and this size was determined at the time of creation. Under certain conditions, this size could be modified without losing data, but too often such conditions did not apply to the size you'd like to enlarge. On the contrary, APFS removes most of those limitations and lets volumes make use of any free space available on the disk. This way, any space which is unused can be assigned to any volume where it is needed. There is only one exception – volumes have to be located in some wine container. Container is the main object type for storing data in APFS. Containers are usually exactly the same as the GUID partition table, or GPT entries. They have their own crash protection and disk space allocation scheme. Each container includes one or several volumes, each of them having its own set of files and directories. Containers can only be created in APFS disks, and only Mac computers with high Sierra operating system or higher can read and write to such disks. Windows computers require special software to access APFS volumes. Let's recover data from APFS file system without having to use any additional tools. It finds such partitions and adds them to the drive manager. For data recovery, you need to connect an APFS drive to a Windows computer. The APFS file system is designed to store data in its directory, which contains all other directories and files. FastScan locates the disk with sector which contains a link to the partition table in GUID or MBR format. After that, we can search the partition table for the superblock container of the APFS file system. When starting FastScan, our program scans container superblock first, then it looks for container object map. Using the map, the program finds out whether volumes of this container are located, analyzes every volume, and looks for volume object map. When the map is obtained, it finds the root directory of every volume that contains the information we need, files and folders containing data. When running FastScan, the program only reads a small part of the disk and only looks for the blocks I have mentioned. As a result, it takes very little time to complete the scan. On the other hand, full analysis makes the program analyze the entire disk from the first to the last block. This is how it works. The information we need is stored in the root directory, which contains names of files and folders, links to their contents, etc. In FastScan, the program scans blocks one by one to reach the last element, the root directory. On its way to the root directory, it comes across other useful information, for example, block size. Here is this line that sets the sizes for kilobytes. In FastScan mode, the program has to go down this sequence of links in order to reach the important elements of the disk. When running full analysis, the program can analyze data even if some of those links are missing, such as container superblock or object map or volumes. If your disk is missing the sectors where information on one of these blocks was stored, such as container superblock, object map, volumes, but it still retains the sectors where information on the actual files is kept, the program can exclude one of those blocks from the chain of analysis and final reach the necessary information in the root directory. The APFS file system is designed in such a way that our program can exclude almost all those blocks from the chain of analysis and extract the information required for recovery. For example, when you run full analysis and the program fails to find the first block, it won't be able to display such information as disk name, free space available, etc. But in the end, it will rebuild the file system even without the missing data and find the information you are looking for. This is a feature that distinguishes it favorably from the rivals. Most of them need the disk structure to work properly, and if one of the chain elements, such as container superblock, object map or volumes, is missing, they can't find the deleted data or even can't recognize the disk at all. To prove the point, let's do some testing. There's a computer with macOS Catalina installed on it. We have created a structure of several containers with volumes inside each of them. For our benchmarking assessment, we have selected several popular data recovery tools. They are Hetman Partition Recovery, RStudio, EaseUS, DiskGrill and Recover. As we examined the tools more closely, we had to exclude DiskGrill and Recover from the list, as they don't support APFS file system. It was an astonishing fact, because these products are among the most popular solutions and DiskGrill even sets the recovery standard for Mac computers. Finally, we have chosen three programs for the test. Hetman Partition Recovery, RStudio and EaseUS Data Recovery Wizard. Let's copy some data to the disk. For example, photos, videos, documents. Remove some of the files and shut down the computer. We'll perform the tests on another computer running Windows. Let's connect the APFS disk to that computer and start the testing with Hetman Partition Recovery. As you can see, the program recognized the disk with APFS file system properly. Open it, select full analysis, next, and wait until the scan is over. Let's check the results. The program has found one disk, 27 folders and 130 files. Ready? Here is the volume we've been scanning, the remaining files and the deleted files marked with the red cross. Summing up, the program was able to find all deleted files without effort. And a preview feature lets you see their contents. The only thing left to do is to save them. Time for candidate number two, RStudio. It also recognizes the tested disk and its file system. Click to see the disk contents, and you are shown some files, but the deleted files are not available. All right, maybe we should have scanned the disk first. Stop the scan and wait until it is over. The picture is completely different now. The container includes several disks. Click to open them, and here they are, the files we need. You see, RStudio also managed to find all deleted data. The files that have been removed are marked with the red cross and available for preview. All right, candidate number three is US. It's going to be more difficult to recognize the disk we need. If the computer has several disks, you'll have to do some searching first. If you click Can't find location, the disk manager will open. Unfortunately, the file system is not specified anywhere. Let's try to find the necessary disk by contents and start opening the disks one after another. Hmm, finally, this is the disk we are using for the test. We were able to find it by its capacity, but there is no information on the file system at all. Scan the disk. The program fails to display the disk structure, unlike the two other candidates. The files are only sorted to folders by file type. There are no markings to suggest if this is the deleted data or the data which is still on the disk, so it's hard to tell whether the program was able to find all the removed files or it decided to display all the files. The only hand we could use was the number of documents, photos or videos which are shown in each folder. No, in the number of files we can say that the program has handled the task well, though it failed to restore the directory tree. We can state with certainty that all programs have coped with the task, but some were rather inconvenient to use. Now, let's make the conditions more complicated. We are going to simulate a case with damaged container superblock. Previously, we have already explored what a container superblock is and discovered that it is located in the first two sectors of the disk. Just modify it with a hex editor and erase those sectors occupied by container superblock. Then, we are going to scan it and check the results. By the way, here is one more important remark – EaseUS has no option to save a disk image and then mount it and use for further recovery operations, which is quite unsafe when you are dealing with cases of data loss. Every time you run the scan, there is a risk of losing important data, so the best way to scan the disk is actually using its image rather than the actual volume. Such approach will increase the chances to recover files without causing additional damage. All right, the boot sector container superblock is erased. Let's run the test. Let's try the first two on the list. Hetman Partition Recovery recognizes the disk and its size, but fails to see the file system because the container superblock has been erased. Open the disk, full analysis, check APFS file system, wait until the scan is complete. The result is one disk, 27 folders, 130 files. Here is the APFS container and the disk name has changed. Here are all the files that have been on the disk and the ones that have been deleted. The disk structure is retained and all folders are located right where they used to be. Summing up, the program managed to find all the data and the files can be previewed before recovery. Now, let's try RStudio. It can recognize the container, but the preview option is unavailable. Okay, scan the storage device. In the end, the program recognized the disk, its file system APFS, and all files are good for preview. Summing up, RStudio product completed this test as well. Let's try another candidate, ESUS. Scan the test disk. Let's see what it can do. After checking the folders, we can say all files have been found. Here are the documents, videos and photos. So far, all the programs have passed this test successfully and managed to discover all the lost files like a charm. Another test is going to be more difficult. In addition to the poor container superblock, we will remove volumes, that is the information on the disks inside the APFS container. Run Hetman Partition Recovery. Full analysis, APFS. The result is one disk, 27 folders, 130 files. Here is the container and the disk. All the files are available for further actions just like in the previous test. The disk structure is retained. The test is passed. Now RStudio. Let's scan the container. With a similar result, all files are available, the program has completed the test successfully. Let's see what ESUS can do. Scan the disk. Here you are. All the files are here. It is a bit inconvenient, though, that the program doesn't display the disk structure and you need more time to understand that all the files have been found. The test results are good for all the programs. All files are available for recovery. Let's move on to the next test. In addition to what we've done before, let's erase the object map and volumes map to simulate a case with damaged container superblock, volumes, object map and volumes map. All right. The maps have been erased. Let's start testing. Let's scan the disk with Hetman Partition Recovery. The same result we've seen before – one disk, 27 folders, 130 files. Open the container, find the disk. All lost files are available and can be previewed. The program has coped with the task – the test is passed. Now let's try RStudio. Scan the container. Hey, that's interesting. RStudio failed to find the test disk. As it appears, when the object map and volume map are removed, the program's algorithm has no way to find any information about the disk and can't find its data either. It says the selected disk doesn't contain any supported file systems or the file system is corrupted. Select the Scan command from the Drive menu to find all partitions that have ever been located on the same disk space. A deeper scan could be more productive, but it takes much longer and it doesn't restore the full destructor, file names and so on. So that is why we're not going to use it now. However, if you're interested to see a deeper scan test, leave a comment under this video. Meanwhile, we have the first candidate that failed the test. We are going to see how ESUS can handle this task. The program can recognize the test disk. Let's scan it. Here, 18 files have been discovered. ESUS managed to find the lost data with the same result as in the previous test. Most likely it is using in-depth analysis when scanning the disk, because the files are sorted into folders by file type. Such type of analysis requires a lot of time and fails to retain the file names and full destructor, which makes searching for specific data more difficult. Still, the program has coped with the task, and we can begin the final test. Here we go. I've already mentioned that APFS is based on a B3 pattern which branched nodes referring to following nodes of the tree until the reached leaf nodes. In this test, we're going to simulate a situation when one of the nodes, or all of them, are lost. We will remove the entire tree structure and leave only the elements we need. And we begin with Hetman Partition Recovery. Start the program, open the disk, full analysis, check APFS file system. The same result again. One disk, 27 folders, 130 files. Open the container, find the disk. As you can see, all files are present and available for preview. The only step left to take is to recover them. We have excluded RStudio from this test, as it failed the previous one, and we expect the same should happen again. Now is U.S. Start is U.S. The program can recognize the test disk, so let's scan it. You can see the result on the screen – 18 files have been found. Let's go over the folders to see what is going on. Here are the documents, photos and videos. Similarly to the previous test, the disk structure is missing as well as file names, and is difficult to find the lost information. In a scenario involving large numbers of files, it's going to take a really long time to rummage through every folder until we can find the specific files you need. However, the program did find the lost data. Now, let's draw the bottom line. We've got two products that have passed all the tests, and one more that failed at the last stage. And the tool to use is entirely up to you, but there is something I'd like to add. The algorithm used in our product allows us to retain the folder structure and file names which makes it easier to search for certain data and saves your time. In addition, our program lets you create a disk image and then recover data from there, which is the interesting standard for dealing with faulty drives. Another favorite is U.S. It has very good results, but doesn't offer this option. And that is all for now. Hopefully, this video was useful. Remember to click the Like button and subscribe to our channel. Push the bell button to receive notifications and never miss new videos. Leave comments to ask questions. Thank you for watching. Good luck.