hoakley April 1, 2022 Macs, Technology

A brief history of APFS in honour of its fifth birthday

On 27 March 2017, Apple made one of its biggest corporate gambles. When it rolled out iOS 10.3 that day, the installer silently converted the storage in each iPhone and iPad to the first release of Apple’s new file system, APFS. Had a significant percentage of conversions gone wrong, Apple would have had a disaster on its hands, particularly as it didn’t admit to doing this until WWDC just over two months later, when it announced that APFS was coming to macOS 10.13 High Sierra that September.

macOS Sierra already had a pre-release version for those who wanted to preview it. That ended its life in 10.12.6 as version 0.3, or, expressed in subsequent numbering, 249.7.6. As we discovered when we upgraded to High Sierra, though, that was a far cry from what was to come, and never achieved any useful level of compatibility with it either.

After a promising period in beta-release, Apple discovered fundamental problems in support for its popular Fusion Drives. The first release version, 748.1.46, which shipped with High Sierra 10.13, therefore suddenly dropped support for those, and went ahead and converted startup volumes on SSDs and hard disks. Snapshots were still wobbly, and it quickly became clear that APFS wasn’t going to perform well on rotating disks.

High Sierra had a stormy early release history, marred by a series of security gaffes. Vulnerabilities were fixed in the Supplemental Update released less than two weeks after 10.13, which included changes to bring APFS to version 748.1.47. Snapshots were improved in 10.13.1 on 31 October, in APFS 748.21.6. Many of us anticipated that the problems with Fusion Drives would be fixed quickly, but APFS reached version 748.51.0 in 10.13.4 on 29 March 2018, and didn’t change version or capabilities until the release of Mojave that September. Another problem which marred the introduction of APFS to all platforms was the refusal during beta-testing to incorporate Unicode normalisation; this had to be resolved in release versions of macOS 10.13 and iOS 10, as explained here and here, although even now problems occur occasionally.

On 24 September 2018, Apple released Mojave 10.14, at last with support for its Fusion Drives. This was also the time that the first version of the Apple File System Reference became available. Although a long and detailed document, developers quickly realised how incomplete it was, in spite of the long delay in its publication. At last third-party file system developers had some hard information to work with. Users began to think that the first third-party disk maintenance and repair tools were now imminent.

By 22 July 2019, when 10.14.6 was released to end Mojave’s cycle and Apple’s last 32-bit support, APFS had reached the dizzying version of 945.275.7, making it seem far more mature than its tools felt. Exceptionally, Mojave’s release of APFS is the only one which has continued to be patched when it went into security-only maintenance. Since 10.14.6, Apple has updated it again in Security Update 2 (945.275.8), and by Security Update 2020-005 (945.275.9).

Catalina brought major changes to APFS, with the use of expanded volume roles to form System Volume Groups, and we’ve all come to live with separate firmlinked System and Data volumes ever since. macOS 10.15 came with APFS version 1412.11.7, and by 10.15.5 had reached 1412.120.2, which fixed a serious bug preventing the transfer of very large amounts of data to RAID volumes. At about that time, Apple released the current version of the Apple File System Reference, which encouraged users’ expectations that third-party tools were just round the corner, while confirming to developers that Apple had no intention of releasing complete documentation for APFS.

Further major changes came with Big Sur 11.0.1 when it was released on 12 November 2020. For the first time, the System volume was signed, sealed, and booted as a snapshot. This was also the first release of macOS to support making Time Machine backups to APFS volumes, and to support Apple Silicon Macs. These arrived in APFS version 1677.50.1, and followed by fixing a vulnerability in 1677.81.1 released in macOS 11.2. The pace of change slowed towards the end of Big Sur’s time in the limelight: 11.5 came with APFS version 1677.141.1, and 11.6 with 1677.141.2, if that’s anything to go by.

The first full release of Monterey came with APFS 1933.41.2, which had gained support for a new range of M1 series models, but otherwise shouldn’t have undergone the same major changes that came with previous major new versions of macOS. What is unusual, though, is its version numbering. As I show below, APFS has consistently stuck to the same major version through each macOS cycle, but that has recently been broken in Monterey. While macOS 12.2 featured APFS 1933.80.3, 12.3 has 1934.101.3, although there don’t appear to have been any changes warranting that major version increment. Could it have been a clerical error, or has there been a big change which none of us has spotted?

Version numbering

It’s dangerous to read too much into changes in version numbers, as different engineering teams use them very differently. However, APFS version numbers can be important, as they’re referred to in the file system and may be quoted in terms of which version created a given container or volume, and which last modified it.

APFS major version numbers change with major version of macOS:

macOS 10.12 has APFS version 0.3 or 249.x.x
10.13 has 748.x.x
10.14 has 945.x.x
10.15 has 1412.x.x
11 has 1677.x.x
12 has 1933.x.x until 12.2, thereafter 1934.x.x.

Minor version numbers increment according to the minor version of macOS, and patch numbers wander without pattern:

macOS 10.13 went through 748.1.46 (10.13) to 748.51.0 (10.13.4 and later)
10.14 went from 945.200.129 (10.14) to 945.275.9 (10.14.6 with SU 2020-005)
10.15 went from 1412.11.7 (10.15) to 1412.141.1 (10.15.6 and .7)
11 went from 1677.50.1 (11.0.1) to 1677.141.2 (11.6)
12 started on 1933.41.2 (12.0.1), then to 1933.61.1 (12.1), 1933.80.3 (12.2), and to 1934.101.3 (12.3).

Changing version numbers thus aren’t any indication of the scope or magnitude of changes made to APFS. As Apple seldom provides any information on changes made to APFS, it’s anyone’s guess as to what is going on.

Thanks to Michael Tsai for twisting my arm and making me mention early normalisation problems.

34Comments

Add yours

1

Andrew on April 1, 2022 at 6:37 am

A brief typo, I think, when you mention Big Sur 11.0.1 being released on 12 November 2021. I think you probably meant 2020?

LikeLiked by 1 person
- 2
  
  hoakley on April 1, 2022 at 7:32 am
  
  Thank you – corrected.
  Howard.
  
  LikeLike
3

Norm G. on April 1, 2022 at 7:17 am

Interesting reading, including the link back to High Sierra and APFS in September of 2017.

I had a 2012 MacBook and was running Sierra. When High Sierra came out, it was not supposed to try to install APFS on Fusion Drives, which was what I had in my 2012 laptop.

RESULT: The updater bricked my machine. The update would not finish and there was no way to go back.

SECOND RESULT: Apple bought my bricked 2012 MacBook, by sending me at no cost, a 2017 MacBook Pro. They allowed me to pay $200 to get a bigger HD and more RAM.

Apple does not give away free products to lowly humans. Influencers and reviewers get free stuff on loan (that they never need to return until the next version is loaned to them), but mere mortals pay full retail.

Apple did some investigating and some numbers of users with bricked computers, and they were bricked by Apple’s bug ridden updater.

THIRD RESULT. Version 1.1 of the updater was released in record time, literally a matter of days, before Version 1.0 could do more damage.

FOURTH RESULT: Apple buried the story. They gave away 50 or 70 or 90 or who knows how many new computers as a result of some programmer not putting in the correct code to skip the file format conversion on the 2012 model with fusion drives.

FIFTH RESULT: I lost that 2017 model in an insider burglary of my home, and I had to go buy a 2018 replacement plus a new iPhone 10s Pro Max to replace the Model 8 that was stolen. I didn’t replace the ancient iPad. No insurance on any of it.

Makes a great story though: Apple gave me a free brand new MacBook Pro computer worth $2,500. Imagine that! I never win in any drawing, horse race, casino or contest. But I won a free computer from Apple. And actually had a dedicated executive level person in Apple’s offices in Austin overseeing the whole process. Apple really wanted me to be delighted.

LikeLiked by 1 person
- 4
  
  hoakley on April 1, 2022 at 7:39 am
  
  Thank you.
  Which model of Mac was this? Are you sure it was a notebook, as I can’t find any reference to notebook models of that era having Fusion Drives?
  Apple doesn’t give “free stuff on loan” to many, if any, reviewers. I’ve written about Macs for print publications since around 1989, and Apple has never provided me with anything free. Nothing. Ever. I pay the same prices that you do, and always have apart from when Apple offered developer discount, which ended a long time ago.
  Howard.
  
  LikeLike
  - 5
    
    Matt N on April 4, 2022 at 3:52 am
    
    So here’s a funny story. Sometime after iCloud debuted and Apple had introduced their synching scheme across devices, I was using that stuff to synch my contacts and calendar between my iPhone and MBP 2011. This was ~2014, maybe? Anyway, I broke iCloud. Like, seriously fried it somehow. I was on the phone with Apple Tech Support probably 20+ times over the next month or so with ever-more senior tech folks and engineers. Finally, towards the end, I was on the phone a couple of times with someone who was described to me as iCloud’s lead engineer for the whole thing! True or not, they were very senior and very interested in examining my use and pattern, etc.
    
    I probably spent 20+ hours on the phone with them over this time. And in the end they were very thankful for all my time and effort and wanted to compensate me. ***US$100*** in credit lol. Hilarious. But I didn’t mind; it had all been very interesting. And by chance I badly needed at $100 item — an Airport Express that I wanted to use to get a printer onto my little home network. Perfect. It recently died but I got several years of quality use from it.
    
    LikeLiked by 1 person
6

Norm on April 1, 2022 at 8:14 am

It was a 2012 Model MacBook. I don’t think it was called a MacBook Pro back then. All I knew was that High Sierra could be installed on a 2012 Model, but the APFS conversion would not be done. The computer would remain on the old file system.

That was what was supposed to happen. But didn’t. Some low-level programmer, whose job it was to write installers and updaters, obviously did not do the job correctly. This is 2017, so maybe they didn’t have an old 2012 model lying around to test it?

No, Apple doesn’t give free stuff to too many people. But famous people got free stuff: celebrities, authors, politicians, musicians, etc. I worked for Computer Intelligence Info Corp and Van Baker & Aaron Goldberg were analysts.

They got a lot of free evaluation software in those days, and that wasn’t on loan, just gifted. There was another analyst who did hardware and cost analysis. He would open the computers and take them apart to figure out each of the components, and then try to derive what that component cost.

Before Computer Intelligence, I was a Branch Manager for Businessland and managed the Oakland, California store. We moved many Apple products. At our 100% Achievement Club at Disneyworld, in 1988, Steve Jobs himself came to host probably the most amazing party I’ve ever attended. I heard the budget was like $150,000 in 1988 dollars for a 6-hour party.

Suffice it to say, they removed all the ceiling tiles in the ballroom, so they could install twinkling lights, rope and balloons. The brought into the ballroom tons of beach sand, so we could play beach volleyball indoors or sit on beach chairs and recliners. The food and beverages were dispensed from real wooden boats. When the band took a break, the DJ started up. They keep bringing out more food, soda, and booze until people had all they wanted.

As to Apple hardware, it wasn’t described as free stuff, they were “evaluation” units and Apple expected to get them back. They were on “short term” loan. But Apple didn’t make too aggressive an effort to get the loaned computers back quickly after the evaluation.

LikeLiked by 1 person
- 7
  
  hoakley on April 1, 2022 at 9:02 am
  
  Thank you.
  There was a MacBook 2010, which came with a hard disk, or a MacBook 2015, which came with Flash storage. MacBook Pro models started in 2006, and there were four new in 2012, none of which offered a Fusion Drive. When APFS came in High Sierra, I had an iMac with a Fusion Drive, and it wasn’t converted to APFS – indeed, the only Fusion Drives which were that year were enrolled in the High Sierra beta programme. It was one of the major issues with High Sierra, which Apple didn’t address until Mojave, despite repeatedly promising a fix was coming shortly.
  I can confirm that the only evaluation and development units provided to me, as a developer, were charged for under schemes which required their return – the recent DTK for Apple Silicon was a good example. Apple charged $500 for that, with return required within 12 months. In the end, it recalled them early, and *required* their return, albeit providing a discount incentive scheme for those who returned them in time.
  Sure, a very few select ‘friends’ were and are favoured. But the myth that Apple has ever been generous with journalists or developers is simply untrue. And I write that as someone who managed to get a free IBM PC XT out of IBM, but that’s a story for another day.
  Howard.
  
  LikeLike
8

EcleX on April 1, 2022 at 8:34 am

Thanks for the interesting article. Would you consider that APFS and Disk Utility are mature already, or is there something still missing or expected in them? I mean, your best guess…

LikeLiked by 1 person
- 9
  
  hoakley on April 1, 2022 at 8:50 am
  
  Thank you.
  There are always bugs to fix, and APFS will no doubt gain new features in the future. I see nothing to suggest that it’s ‘finished’ in the sense that HFS+ is now. Maybe WWDC will reveal the next changes to watch for, although as far as low-level features like firmware and file systems are concerned I think this year will again be more consolidation rather than change in those areas.
  So perhaps the word is maturing rather than mature.
  Howard.
  
  LikeLike
10

NSSynapse (@NSSynapse) on April 1, 2022 at 2:32 pm

Here’s a fun anecdote from Craig Federighi for the beginning of the APFS timeline:

> We actually had this process running for earlier iOS updates … where when you updated to 10.1 or 10.2, we were trial migrating your whole file system … consistency checking it … reporting back to us whether the upgrade was 100 percent clean, then rolling it back.

(Source: )

LikeLiked by 1 person
- 11
  
  NSSynapse (@NSSynapse) on April 1, 2022 at 2:35 pm
  
  Looks like my attempt to turn the URL into a clickable link actually caused it to get swallowed. Here’s the URL as plain text:
  https://www.macobserver.com/analysis/apple-dry-run-apfs-prior-ios-10-3/
  
  LikeLiked by 1 person
- 12
  
  hoakley on April 1, 2022 at 2:47 pm
  
  Thank you.
  Yes, I remember that, although I think it was actually Eric Tamura who originally revealed that during his 2017 presentation at WWDC: “one of the reasons that we were able to do this so successfully is that we actually employed a dry run conversion during iOS 10.0, 10.1, and 10.2 and be able to track how the health of our conversion process was actually going.”
  Even so, the gamble in 10.3 was huge.
  Howard.
  
  LikeLike
13

Jack on April 1, 2022 at 5:44 pm

Say I have numerous Apple computers on hand, each running a different version of macOS, and I want to format an external drive to APFS. Is it preferable to do so using the newest version of macOS? If so, do you recommend reformatting old APFS drives that were originally formatted with macOS 10.13?

LikeLiked by 1 person
- 14
  
  hoakley on April 1, 2022 at 7:34 pm
  
  That depends what you want to do with that disk in terms of format and encryption.
  APFS is surprisingly backward and forward compatible given the great changes it has gone through in those five years. If all you want to do is store regular files and folders on a single volume without encryption, then it doesn’t make a big difference. I’d go for the most recent version of macOS you have, just to ensure it has most issues fixed. However, you don’t need to go back and reformat old disks unless you’ve got nothing better to do.
  If you want to use multiple containers or encrypted volumes, that gets a bit more difficult, and to be honest the best approach then is to use the most recent macOS and test on the oldest before you put too much work into filling the disk.
  One potentially better solution for those who have to retain access to older versions of macOS is to run them in a VM on the most recent version of macOS. Then all those issues are taken care of by the virtualising software. Of course, that only works for an Intel Mac host.
  Howard.
  
  LikeLike
15

pen-helm on April 1, 2022 at 7:36 pm

I guess there’s never going to be a new DiskWarrior, then 😦
There is sometimes APFS corruption, according to Mike Bombich… how to fix it?

LikeLiked by 1 person
- 16
  
  Gord L on April 1, 2022 at 8:02 pm
  
  Alsoft says on their website that they’re hard at work on “the next major release (DiskWarrior 6.0)”, that will feature “the ability to rebuild APFS disks.” (Click the red banner at the top of the front page.)
  
  Not sure what ”rebuild” could mean here, since (as far as I understand) APFS doea not have the inherent issue that HFS+ has, namely a central “directory” of file information that can get corrupted over time in various ways, and which can benefit from being optimized and rebuilt. And I’m not aware of complaints of APFS errors or data loss. But I guess we’ll see what they have in store.
  
  Alsoft has certainly earned our trust, so I imagine the upgrade will be worthwhile.
  
  LikeLiked by 1 person
  - 17
    
    hoakley on April 1, 2022 at 10:14 pm
    
    Thank you.
    The problem inherent in HFS+ is that it doesn’t use copy-on-write when making changes to the file system metadata. This means that anything that interrupts a write to a disk risks leaving an HFS+ file system in an unstable, damaged state. APFS addresses that by using copy-on-write to file system metadata, greatly reducing the chances of such errors occurring.
    Most of us had to use Disk Warrior every few weeks to keep on top of the accumulated errors. That shouldn’t be necessary with APFS. So whether Disk Warrior for APFS will ever be as useful as it has been for HFS+ remains to be seen.
    Howard.
    
    LikeLike
- 18
  
  hoakley on April 1, 2022 at 10:08 pm
  
  No one knows whether there will be a Disk Warrior for APFS, or, if there is, whether it would have any value.
  Older versions of APFS do have some bugs, and I’m sure there are circumstances in which users can get corruption. Disk Utility’s First Aid uses fsck_apfs, the only tool so far able to tackle repair. I have several articles here about using them.
  Howard.
  
  LikeLike
19

Rob on April 1, 2022 at 7:46 pm

We all can have issues with things Apple has done but there is no denying they have done some major heavy lifting to the MacOS for the past 5 years. APFS was the most needed and therefore the most significant. I wish we’d had more information along the way and support for 3rd party tools and hardware (NAS). Beyond that, there’s not much to bitch about. Good article Howard.

LikeLiked by 1 person
- 20
  
  hoakley on April 1, 2022 at 10:08 pm
  
  Thank you.
  Howard.
  
  LikeLike
21

TimR on April 2, 2022 at 11:34 pm

I suspect the APFS version changes have to do with Dropbox/Onedrive needing to rewrite their apps. Particularly features such as on-demand files seem to have changed with 12.3:
https://help.dropbox.com/installs-integrations/desktop/macos-12-monterey-support
https://techcommunity.microsoft.com/t5/microsoft-onedrive-blog/inside-the-new-files-on-demand-experience-on-macos/bc-p/3066588

Whatever the details, companies like Dropbox and Microsoft needing to scramble to update their code mid-OS cycle is consistent with that version bump.

LikeLiked by 1 person
- 22
  
  hoakley on April 3, 2022 at 7:15 am
  
  Thank you.
  No, as I have explained, these relate to their reliance on a kernel extension which isn’t available to them from 12.3 onwards. They don’t go anywhere near file system level.
  Howard.
  
  LikeLike
23

Karsten Jensen on April 5, 2022 at 8:23 pm

As always, very interesting and informative, even for a novice as I. Thank you. How does one find the APFS version number?

LikeLiked by 1 person
- 24
  
  hoakley on April 5, 2022 at 9:00 pm
  
  Thank you.
  I inspect this in every macOS update and upgrade, using my own app. I’m not sure how you’d go about it otherwise, as the version shown for apfs.kext in the Finder is bogus.
  However, when you run Disk Utility’s First Aid or fsck_apfs, version numbers are normally given for when each volume or container was created, and when they were last modified. That’s why I’ve given the versions here, so that users can work back to discover the version of macOS for that version of APFS.
  Howard.
  
  LikeLike
  - 25
    
    Karsten Jensen on April 5, 2022 at 9:48 pm
    
    I found it. Thanks. My current version is 1934.120.3.0.1
    
    LikeLiked by 1 person
    - 26
      
      hoakley on April 5, 2022 at 10:36 pm
      
      That looks like 12.4 beta, then?
      Howard.
      
      LikeLike
    - 27
      
      Karsten Jensen on April 5, 2022 at 10:41 pm
      
      Yes! You are quick 🙂
      
      LikeLiked by 1 person
28

JJ on April 9, 2022 at 3:11 pm

APFS has been around for 20 years. It was what BEOS ran on. A company I invested in right before Jobs was about to buy it for Apple to be what OSX was. But Jobs had a personal issue with one of the heads at BEos who left apple to work there and he decided to f him and me over. BEOS was one of the most if not the most advanced OS at the time and would have been amazing on a Mac. Think how much further apple would be. Years of OSX suffering, It was like having to grow up going from dos to win32 to windows 95, 98, ME, XP, then finally windows 2000 server until I moved to OSX. Then OSX went through those same (but not was insane) growing pains. BEos was a mature … (fill in your fantasy here) beast that was ready to run.

LikeLiked by 1 person
- 29
  
  hoakley on April 9, 2022 at 3:49 pm
  
  Thank you.
  That’s not what Dominic Giampaolo says, and as he wrote the Be File System, has worked for Apple since 2002, and has written a whole book about the Be File System, it isn’t hard to check.
  The Be File System was written primarily for magnetic media, including floppy and hard disks. It uses journalling but not copy-on-write, whereas APFS doesn’t use journalling at all, but does use copy-on-write.
  Before Giampaolo started work on APFS, it was he who was largely responsible for adding journalling to HFS+, which also doesn’t use copy-on-write, so it’s oddly more accurate to say that BFS was the ancestor of modern HFS+ than of APFS!
  I was a BeOS developer, and until fairly recently still had my pre-release development system. So, yes, I loved BeOS, but it’s a far cry from Mac OS X, with its origins from both NeXT and Mac. BeOS was pretty magic for the time, but I’d hardly call it mature in the sense that classic Mac OS and NeXTSTEP were. It also had no support whatsoever for classic Mac OS, so would have had the same integration problems that Mac OS X did.
  Howard.
  
  LikeLike
30

Microwave on April 12, 2022 at 6:41 pm

Hi Howard, I’m writing here, since in the most recent post on disk encryption, from Summer 2021, I cannot comment any longer, and this is at least somewhat about APFS. Judging from your top-notch posts (not to mention that from Summer), you seem to be extremely familiar with both APFS and FileVault2. That is, why perhaps you could point me to some internals/developers pages targeting file recovery on APFS and/or FileVault2, regarding the following issues.

I recently had to battle against APFS peculiarities. Goal was to properly prepare for recovery of non-securely deleted files (as in “deleted from trash” or “deleted by rm -rf”) from a FileVault2-encrypted APFS volume within the image. The source image was gained by running dd on a non-T2 Mac. For acquiring the unencrypted raw bytes, I wanted to simply unlock the volume and perform a second dd from the so (temporarily) unlocked source volume to the final target image. Knowing the password, the source image was quickly unlocked and mounted (and remounted as read-only, as not to alter the source filesystem). But both on High Sierra or Catalina it would not let me access that “synthesized” APFS volume, despite having unlocked it and having SIP turned off, and acting as root user. Accessing the whole container was permitted, but that only returned the encrypted bytes. Hence, I could not find any viable way to get hold of the (temporarily) unencrypted raw bytes.

Because of that I saw no solution other than writing the image to a disk and decrypting that “cloned” source disk. Interestingly enough, diskutil would not begin decryption unless the “precious!!” source disk was mounted as read-write!!! Gave me some grey hairs to figure that one out, since that is exactly NOT what you want in a recovery attempt!

TL;DR: Given that the FileVault2 password and user be known:
– Is there any documented/undocumented way, possibly employing an open source .kext or whateves, to on-the-fly raw access (read-only is sufficient) a FileVault2-encrypted diskNsM-style APFS volume without specialized data recovery SW? Will there be encrypted or decrypted bytes in such a raw access if it is possible in the first place?

– Is there any other way to get hold on-the-fly of the decrypted raw bytes from a disk/image with a FileVault2-encrypted APFS volume in it?

– If there is no on-the-fly solution: Is there any way to decrypt the volume if it is NOT mounted read-write? Kind off “no single process except diskutil/fdesetup are allowed to write to the filesystem (those two would do so only for in-place decryption), particularly not Finder or noisy SpotLight services or such…”. Reason: Obviously, every single write could be just one too much, so under all circumstances random writes to the unlocked filesystem need to be avoided.

Environment available: Full-system or recovery mode on both a High Sierra or Catalina Mac.
If need be: External-booted Arch Linux.

Many thanks!

LikeLiked by 1 person
- 31
  
  hoakley on April 12, 2022 at 9:14 pm
  
  Thank you.
  I’m not aware of any code or product which is freely available. This may well be catered for by advanced repair tools, but not those available to the public. I also believe it’s a feature of all the better forensic toolkits, for which you’d need to contact their vendors. Sadly I think they’re expensive.
  I wish you success.
  Howard.
  
  LikeLike
- 32
  
  David B. on April 12, 2022 at 10:45 pm
  
  Hello!
  I’m totally out of my depth with what you are talking about, but …..
  You might like to take a look at Disk Drill which I used some years ago to recover lost data. https://www.cleverfiles.com
  It MAY just help you. Good luck! 😅
  
  David
  
  LikeLiked by 1 person
- 33
  
  Microwave on April 14, 2022 at 12:19 am
  
  Thanks for your thoughts to both of you.
  
  Yes, the day before writing the first comment, I chatted with some Disk Drill developers and asked a few of my questions, whether Disk Drill would be able to read-only access those unencrypted raw bytes. They suggested it would, so I downloaded it but have yet to give it a try.
  Even if there was free recovery as well (Free Disk Drill Basic edition will only report found files and won’t recover them, but that’s fine with me), I always hated using technologies I cannot understand to perform seemingly simple “command line” tasks.
  
  One thing I might try is to get an Arch up and running on a USB key until able to use the AUR, then obtain something like “apfs-fuse” from there. Then boot and figure out whether simple unlocking really works, whether I can access a single APFS volume and whether I could see the plaintext raw bytes when succeeding.
  
  Or yeah, still, let Disk Drill perform its sorcery, employing its custom .kext (They have advertised that).
  
  Kind regards
  
  LikeLiked by 1 person
  - 34
    
    hoakley on April 14, 2022 at 3:38 pm
    
    I wish you success. I looked through the info on Disk Drill and wasn’t convinced that it could handle APFS let alone encryption!
    Howard.
    
    LikeLike