Best Data Recovery Tools for APFS Drives: Top Picks
-
Author:
Vladimir Artiukh
-
Editor:
Oleg Afonin
Here Are the Top Tools to Recover Data from APFS Drives! Accidentally deleted or lost data from your APFS drive? Don’t worry, we’ve got you covered! In this article, we’ll introduce you to the top data recovery tools specifically designed for APFS drives. Whether you’ve experienced data loss due to accidental deletion, formatting, or system crashes, these tools can help you retrieve your valuable files and documents with ease. From user-friendly interfaces to powerful recovery algorithms, we’ll explore the features and capabilities of each tool to help you make an informed decision. Don’t let data loss ruin your day—watch now and discover the best tools to recover your data from APFS drives!
- Introduction
- The method of recovery
- Test 1. Top Tools to Recover Data from APFS Drives
- Test 2. Container Superblock removed
- Test 3. Volumes removed, with data on APFS internal partitions
- Test 4. Object map removed
- Test 5. B-tree structure removed
- Conclusion
- Questions and answers
- Comments
Introduction
Apple File System or ApFS is the new file system by Apple which is used with latest Mac devices. However, this file system is in no way an extension of HFS+. In APFS, you are not going to find the things we remember from HFS+: Catalog File, Attribute File, Allocation File, and Extent Overflow File, as well as the journal. The new file system uses a different approach to protect changes to the files and their data.
| Characteristic | Description |
|---|---|
| Full Name | Apple File System (APFS) |
| Year of Introduction | 2017 |
| Main Features | Optimized for flash storage, encryption support, high read and write speeds |
| Data Storage Method | Copy-on-Write |
| Encryption | Supports multiple levels of encryption at the file and metadata level |
| Fragmentation | Minimized due to flash storage optimization |
| Compatibility | macOS 10.13 (High Sierra) and later, iOS 10.3 and later |
| Snapshot Support | Yes, snapshots are supported for quick system recovery |
| File System Type | 64-bit |
| Usage | Designed for macOS, iOS, watchOS, and tvOS |
As we know, this file system has been optimized for flash drives and SSDs.
The main innovations in this operating system are improved encryption algorithms, optimized memory usage, crash protection, cloning of files and folders, and smart space usage patterns. In practice, it means more stable operation, increased read/write speeds and even more protection for user data. But what if crash protection didn’t work and some data was lost?
Top Tools to Recover Data from APFS drives or how to recover Apple MacOs disk in Windows
The method of recovery
ApFS offers an opportunity to restore certain states of the file system, including restoration of old or removed versions of files. The container superblock contains a link to the element known as checkpoint. Such checkpoint refers to the preceding container superblock which stores the information on an older state of the file system. This way, we can try to restore several older states of the file system by analyzing this chain of superblocks inside the container.
ApFS is a file system making use of the copy-on-write principle, and that is why every block is copied before changes are applied. Therefore, there is a kind of history for all files which have not been overwritten and comply with the file system structure. This fact leads to a number of artifacts which can be used in the course of file recovery.
Based on what we know about such artifacts, we have defined various approaches to file recovery, relying on various types of artifacts as starting points. All methods deal with the file system in blocks of 4096 bytes which is the smallest block size observed in ApFS. These blocks are checked for presence of metadata structures, which are, in their turn, analyzed and used for file extraction.
Only Mac computers with High Sierra operating system or higher can read and write to ApFS disks. Windows computers require special software to access such volumes.
Data recovery utilities let you recover data from APFS drives without having to use any additional software. They find partitions of this type and add them to the drive manager. In order to recover any information, you need to connect an APFS drive to a Windows computer.
The APFS file system is designed to store data in its root directory, which contains all other directories and files, including the ones we’re interested in.
We have conducted a benchmark involving most popular data recovery tools, and you can find all the results below.
Test 1. Top Tools to Recover Data from APFS Drives
On a computer with mac OS Catalina, we have created a structure of several containers, with volumes inside each of them. After that, we have scanned the test disk with most popular data recovery solutions.
Initially, we have selected the following products for the test: Hetman Partition Recovery, R-Studio, EaseUS Data Recovery Wizard, Disk Drill, and Recuva. As we examined them more closely, we had to exclude DiskDrill and Recuva from the list as they don’t support APFS file system. It was an astonishing fact, because these products are among the most popular solutions, and DiskDrill even sets the recovery standard for Mac computers.
In the end, we have started the test to see which of the three utilities performs best of all: Hetman Partition Recovery, R-studio, or EaseUS Data Recovery Wizard.
We have copied some photos, videos, and documents to the test disk, and then removed some of the data.
We performed the tests on a computer running Windows 10.
Testing Hetman Partition Recovery
The program recognized the test disk with APFS file system properly. In this case of a simple deletion, a fast scan will suffice.
The program was able to find all the files without effort; both the existing files and the removed files are displayed, and the ones that have been deleted are marked with a red cross. Their contents can be previewed if necessary. The disk structure and file names are retained.
All we have to do is to save the recovered files to a disk.
Testing RStudio
This program also recognizes the test disk and identifies the file system type properly.
However, after a quick scan it can’t display any removed data.
After the full scan, the program managed to find the deleted data, and marked it with a red cross. The disk structure and file names are retained, and the files are available for preview.
Testing EaseUS
This program displays the test disk, but we could only identify it by its size, because neither its name nor file system type are shown.
There is no such thing as a quick scan here, so advanced scan starts immediately.
In the end, EaseUS fails to display the disk structure (as the other two candidates did), file names are lost, and the files are only sorted to folders by file type. There are no markings to suggest if this is the deleted data or the data which is still on the disk, so it’s hard to tell whether the program was able to find only removed files, or it decided to display all the files.
The only hint we could use was the number of documents, photos and videos which is shown in each folder.
This program has coped with the task, though it took more time, and it was unable to restore the directory tree!
Summing up, all the candidates have passed the first test, but some were rather inconvenient to use.
By the way, here’s one more important remark – EaseUS has no option to save a disk image and then mount it and use for further recovery operations, which is quite unsafe when you’re dealing with cases of data loss. Every time you run the scan, there is a risk of losing important data so the best way to scan the disk is actually using its image rather than the actual volume. Such approach will increase the chances to recover files without causing additional damage.
Test 2. Container Superblock removed
We have decided to make things more complicated and simulate damage to the container superblock, which is located in the first two sectors of the test disk.
Using a Hex editor, we have erased these two sectors. After that, we have scanned the disk with each of the utilities and received some interesting results.
Testing Hetman Partition Recovery
Just as before, the program recognizes the disk and its size, but fails to “see” the file system because the Container Superblock containing this information has been erased.
In this case, fast scan is no longer available, so we had to use full analysis.
As a result, the program has identified a container with APFS file system.
The disk name has changed.
Hetman Partition Recovery has found all the removed data, all the files are displayed, both those that have been on the disk, and the ones that have been deleted. The disk structure and file names are retained.
The program has coped with the second test as well. All data is available for recovery.
Testing RStudio
It can recognize the container, but a quick scan is no longer available.
After a full scan, RStudio was able to find the test disk and identified its file system as APFS.
The disk structure and file names are retained, all data can be located.
The program has completed the second test successfully.
Testing EaseUS
No changes here, the disk is displayed as before.
After the scan, we opened each of the folders to see the same result as in the previous test: all the data has been found.
All the utilities have passed the second test successfully. They managed to discover all the lost files without effort.
Test 3. Volumes removed, with data on APFS internal partitions
In the next test, in addition to the Container Superblock, we have removed volumes, i.e. the information on the disks inside the APFS container.
Testing Hetman Partition Recovery
No changes again. The program displays the disk just as before.
All the files are available for further actions, just like in the previous test. The disk structure and file names are retained.
Hetman Partition Recovery has successfully completed the third test.
Testing RStudio
The result is the same as before. The program displays the container just as it did.
All files are available, the file names and disk structure are retained.
RStudio has passed the third test successfully.
Testing EaseUS
This utility also displays the disk without changes.
It was able to find all the data.
It is a bit inconvenient, though, that the program doesn’t display the disk structure, and you need more time to understand that all the files have been found.
The test results are good for all the programs. All files are available for recovery.
Test 4. Object map removed
In the next test, in addition to what we’ve done before, we have erased the object map and volumes map, to simulate a case with damaged container superblock, volumes, object map and volumes map.
Testing Hetman Partition Recovery
Just as before, the program recognizes the disk and its size, but fails to “see” the file system.
Let’s scan the disk in Hetman Partition Recovery.
All the lost files are available and can be previewed.
The disk structure and file names are retained.
The program has completed this test successfully.
Testing RStudio
The program displays the container properly.
With quick scan, the program couldn’t find the test disk.
As it appears, when the object map and volumes map are removed, the program’s algorithm has no way to find any information about the disk, and can’t find its data either.
It says, the selected disk doesn’t contain any supported file systems or the file system is corrupted. Select the Scan command from the Drive menu to find all partitions that have ever been located on the same disk space.
A deeper scan and signature search could be more productive, but it takes much longer and it doesn’t restore the folder structure, file names and so on, so that is why we have decided not to run it.
However, if you are interested to see a deeper scan test, leave a comment under this video.
Summing up, RStudio has failed the fourth test.
Testing EaseUS
EaseUS managed to find the lost data with the same result as in the previous test.
Most likely, it is using in-depth analysis when scanning the disk, because the default option is to have files sorted into folders by file type. Such type of analysis requires a lot of time and fails to retain the file names and folder structure, which makes searching for specific data more difficult.
Still, the program has coped with the task, and we can begin the final test.
Test 5. B-tree structure removed
I’ve already mentioned that APFS is based on a B-tree pattern with branch nodes referring to following nodes of the tree until they reach leaf nodes. In the last test, we have simulated a situation when one of the nodes (or all of them) are removed. We have removed the entire tree structure, leaving only the clusters we need.
Testing Hetman Partition Recovery
With full analysis, the program has been able to find all the data on the disk – both the removed information and the files still available; disk structure and file names are retained, all files being available for preview.
The only step left to take is to save them to a disk.
We have excluded RStudio from this test as it failed the previous one, and we expect the same should happen again.
Testing EaseUS
Here’s the result: 18 files have been found.
Checking the folders, we can see that all files are still on the disk.
Similarly to the previous tests, the disk structure is missing as well as file names, and it’s difficult to find the lost information. In a scenario involving large numbers of files, it is going to take a really long time to rummage through every folder until you can find the specific files you need. However, the program has managed to find the lost data.
Conclusion
As the benchmark results suggest, there are two tools that have passed all the tests – Hetman Partition Recovery and EaseUS Data Recovery Wizard. RStudio has failed one of the last tests and dropped out just before the final round. The choice of the best recovery solution to save your data is up to you.
The algorithm used in our product allows to retain the folder structure and file names which makes it easier to search for certain data and saves your time. Also, Hetman Partition Recovery lets you create a disk image and then recover data from there, which is the industry standard for dealing with faulty drives. Unfortunately, EaseUS Data Recovery Wizard doesn’t offer this option.
