How to obtain and read entries in the Unified log made by APFS. Their structure, and a guide to their identification and occurrence.
APFS
Classic Mac OS could give the size of data and resource forks. High Sierra ignored extended attributes, and Sonoma tries to add them, but only includes some.
Union mounts let you merge the contents of two volumes without copying any files. Do they work as expected in Sonoma’s APFS, though?
Other file systems, with an outline of vfs and vnodes used by the kernel, and how they’re important in checking code signatures.
This reference covers fsck_apfs, diskutil information, diskutil apfs, conversion of HFS+ to APFS, mount_apfs, and newfs_apfs.
Overview of clone files, dataless files, sparse files, symbolic links, and firmlinks, and how used and free space is accounted for in APFS.
Keybags, wrapping keys, VEKs and KEKs all explained. Did you realise how Recovery Keys are implemented? Or how the SSV protects against read errors?
What’s in an APFS snapshot, and how the stages in its life-cycle work, from creation, through mounting and unmounting, to deletion and cleanup.
Where would you find a 7C3457EF-0000-11AA-AA11-00306543ECAC? How UUIDs have taken over to identify so much, and how to generate your own.
From the GPT division of storage space, through APFS containers, down to individual volumes, an account of how APFS works.
The Eclectic Light Company 