The file systems of macOS

basic concepts of varios file systems of macOS

As noted in the article on Filesystem basics, an operating system is one of the key factors that impacts the choice of an appropriate storage format. And when it comes to macOS, the available options are restricted by the closed nature of the Apple ecosystem. All modern Macs running macOS 10.14 and later employ APFS by default, which is also shared with the rest of the Apple’s product line – the devices based on iOS, iPadOS, tvOS, and watchOS. At the same time, HFS+, the previous de facto standard, is still supported to preserve compatibility with older machines. Here you can familiarize yourself with these two FS types and their organizational principles. In addition, you can find out how they relate to other storage technologies used within this platform.

Please note: Though macOS allows formatting removable media in FAT/FAT32 or exFAT and offers their read-write support, these filesystems are described in another article in view of their direct relevance to Microsoft Windows.

Content:

APFS

APFS (Apple File System) was introduced in 2017 alongside the launch of macOS High Sierra 10.13 and designed exclusively for usage with Apple products, including Macs, iPhones, iPads, Apple Watches and Apple TV.

The new-generation format aims to work efficiently with flash memory and solid-state drives. And this comes as no surprise, since the vast majority of modern Apple devices employ SSDs as their primary storage. In addition, APFS addresses the fundamental issues of HFS+, its predecessor on the aforementioned appliances, and offers a lot of data integrity and space-saving features.

The filesystem makes use of the Copy-on-Write (CoW) technique, which minimizes the risk for its corruption. Prior to APFS, the changes were written straight to the storage blocks occupied by the existing objects. By contrast, APFS never overwrites them in place – it creates their copies and performs the necessary changes onto a new location on the storage, ensuring that all modifications are protected from possible crashes.

APFS relies on the Container as a principal element for storing data. A single Container can hold multiple volumes (filesystems) that share the storage space available in it. The information about the number of blocks in the Container, the block size, etc. is stored in the Container Superblock, which also acts as an entry point into each volume. The allocation of blocks in the entire Container is tracked with the help of one common Bitmap.

At the same time, volumes have their own Volume Superblocks and independent structures for storing data and metadata. All files and folders in them are managed using binary search tree structures, referred to as File and Folder B-Trees. The nodes in such trees store keys and values.

The content of any file is represented by at least one extent, which keeps the information about its starting location and length in blocks. All extents in the volume are handled by a dedicated B-tree.

Nonetheless, in spite of its optimized structure and other apparent benefits, APFS has been developed with flash storage in mind and might not be the best alternative for mechanical hard disk drives. On top of that, it may cause their excessive fragmentation and thus degraded performance. Also, it is impossible to access an APFS volume under previous versions of macOS – macOS Sierra 10.12 or earlier, which may become an obstacle in certain usage scenarios.

HFS+

HFS+ (Hierarchical File System Plus), also known as Mac OS Extended, was released in 1998 with Mac OS 8.1 and served as a default filesystem for Mac computers, as well as for iPod and Xserve products, before it was replaced by APFS in macOS High Sierra 10.13. Originally, it was just an extension to the legacy HFS format, which is now almost forty years old.

HFS+ implements the journaling mechanism to prevent corruption of its structures. All modifications are documented in the Journal area, which makes it possible to restore them promptly in case of unexpected events, like power failures.

One of the core structures of HFS+ is called the Volume Header, which is available at the beginning of an HFS+ volume. It contains the general FS parameters along with the locations of other crucial elements. Most of the other service information is organized into special files that can be found in different parts of the volume and are mainly represented by B-trees.

The whole storage space in HFS+ is split up into equal allocation blocks. The state of each allocation block is recorded in the bitmap-like Allocation File. As a rule, such blocks are assigned to files in continuous groups, which helps to reduce their fragmentation.

Files may have two sets of data associated with them. The actual file’s content is referred to as a data fork, while the additional information about it is stored as a resource fork. A contiguous sequence of blocks belonging to a fork is called an extent, which is represented by its starting position and number of blocks in it.

The Catalog File has records for every file and directory in the filesystem. Such records contain the majority of metadata and also the first eight extents of each fork. Further extents, if available, are kept in the Extents Overflow File. And, finally, additional attributes related to files and folders are stored in the Attributes File.

Among other things, HFS+ supports multiple references to the same file’s content, known as hard links. Unlike regular files, hard links do not require any extra storage space – they exist in the Catalog File as pointers to the original file, which is itself moved to the hidden root directory.

Although HFS+ has already become outdated, it provides the benefit of reverse compatibility, allowing to preserve access to computers with older versions of macOS. Therefore, it is not likely to fall out of use very quickly.

Hint: The details related to the possibility of data recovery from these FS types can be found in the articles about the peculiarities of data recovery depending on the operating system and chances for data recovery. If you’re interested in the practical side of the procedure, please, refer to the guide on data recovery from macOS.

Other storage technologies of macOS

HFS+ was initially designed for simple use cases and lacks many of the advanced features required by modern Macs. While it works independently in basic setups with standalone drives, this file system relies heavily on additional technologies for more complex tasks. Such technologies add a layer of abstraction on top of this file system, allowing it to manage functions that it’s unable to handle on its own. In contrast, APFS was created with modern storage needs in mind, offering built-in support for many features that previously depended on external solutions.

Some of the most common storage features implemented in macOS include:

  • FileVault – Apple's full-disk encryption technology designed to secure data on a Mac from unauthorized access. When enabled in more recent versions of macOS based on APFS, FileVault utilizes the native encryption mechanisms of APFS to encrypt the content of entire APFS volumes (also referred to as APFS encryption). Unlike its successor, HFS+ doesn’t allow for encryption at the volume level. In this case, it is added as a separate layer provided by Core Storage, another storage technology described below.

    Hint: Please rely on the instruction if you need to recover data from an encrypted APFS volume.

  • Fusion Drive – a storage solution combining a traditional hard disk drive and a solid-state device into a single logical unit in order to achieve balance between speed and storage capacity. Frequently requested data is moved automatically to the SSD for better performance, whereas infrequently accessed data is kept on the slower HDD. Core Storage is responsible for data placement with a Fusion Drive in case of HFS+. On APFS-based Fusion Drives, this functionality is built into the file system itself.

    Hint: Please rely on the instruction if you need to recover data from Apple Fusion Drive.

  • Core Storage – Apple’s logical volume management technology used in macOS versions up to macOS High Sierra. It acts as a layer of abstraction between HFS+ and physical drives, allowing for advanced storage configurations with this file system. Specifically, it serves as a basis for the creation of encrypted volumes and operation of Fusion Drive. When Apple introduced APFS, Core Storage was phased out for volumes formatted with the newer file system.

    Hint: For more information regarding Apple Core Storage please read the article explaining this technology.

  • Apple Software RAID – an embedded macOS function that enables users to create and manage RAID configurations without the need for a hardware RAID controller. It employs software mechanisms within macOS to combine multiple physical drives into a single logical volume, characterized by better performance or redundancy, depending on the chosen RAID level. The possible options include RAID 0 (striping) and RAID 1 (mirroring). RAID can be set up through Disk Utility or the Terminal in macOS and formatted with the APFS or HFS+ file system.

In case you want to learn more about the native formats of other popular operating systems, please refer to the following articles:

Last update: November 08, 2024

If you liked this article, you can share it on social media: