Top Data Recovery Tools For APFS Drives

Read this article about top tools to recover data lost from ApFS drives used on Mac computers or other Apple devices. We will explore thoroughly what each of the utilities can do!

Top Data Recovery Tools For APFS Drives

Introduction

Apple File System or ApFS is the new file system by Apple which is used with latest Mac devices. However, this file system is in no way an extension of HFS+. In APFS, you are not going to find the things we remember from HFS+: Catalog File, Attribute File, Allocation File, and Extent Overflow File, as well as the journal. The new file system uses a different approach to protect changes to the files and their data.

As we know, this file system has been optimized for flash drives and SSDs.

The main innovations in this operating system are improved encryption algorithms, optimized memory usage, crash protection, cloning of files and folders, and smart space usage patterns. In practice, it means more stable operation, increased read/write speeds and even more protection for user data. But what if crash protection didn’t work and some data was lost?

Go to view
 Top Tools to Recover Data from APFS drives or how to recover Apple MacOs disk in Windows

Top Tools to Recover Data from APFS drives or how to recover Apple MacOs disk in Windows

The method of recovery

ApFS offers an opportunity to restore certain states of the file system, including restoration of old or removed versions of files. The container superblock contains a link to the element known as checkpoint. Such checkpoint refers to the preceding container superblock which stores the information on an older state of the file system. This way, we can try to restore several older states of the file system by analyzing this chain of superblocks inside the container.

ApFS is a file system making use of the copy-on-write principle, and that is why every block is copied before changes are applied. Therefore, there is a kind of history for all files which have not been overwritten and comply with the file system structure. This fact leads to a number of artifacts which can be used in the course of file recovery.

Based on what we know about such artifacts, we have defined various approaches to file recovery, relying on various types of artifacts as starting points. All methods deal with the file system in blocks of 4096 bytes which is the smallest block size observed in ApFS. These blocks are checked for presence of metadata structures, which are, in their turn, analyzed and used for file extraction.

Only Mac computers with High Sierra operating system or higher can read and write to ApFS disks. Windows computers require special software to access such volumes.

Data recovery utilities let you recover data from APFS drives without having to use any additional software. They find partitions of this type and add them to the drive manager. In order to recover any information, you need to connect an APFS drive to a Windows computer.

The APFS file system is designed to store data in its root directory, which contains all other directories and files, including the ones we’re interested in.

We have conducted a benchmark involving most popular data recovery tools, and you can find all the results below.

Top Tools to Recover Data from APFS Drives

On a computer with mac OS Catalina, we have created a structure of several containers, with volumes inside each of them. After that, we have scanned the test disk with most popular data recovery solutions.

Top Tools to Recover Data from APFS Drives

Initially, we have selected the following products for the test: Hetman Partition Recovery, R-Studio, EaseUS Data Recovery Wizard, Disk Drill, and Recuva. As we examined them more closely, we had to exclude DiskDrill and Recuva from the list as they don’t support APFS file system. It was an astonishing fact, because these products are among the most popular solutions, and DiskDrill even sets the recovery standard for Mac computers.

In the end, we have started the test to see which of the three utilities performs best of all: Hetman Partition Recovery, R-studio, or EaseUS Data Recovery Wizard.

We have copied some photos, videos, and documents to the test disk, and then removed some of the data.

Top Tools to Recover Data from APFS Drives

We performed the tests on a computer running Windows 10.

Testing Hetman Partition Recovery

The program recognized the test disk with APFS file system properly. In this case of a simple deletion, a fast scan will suffice.

The tool recovers data from any devices, regardless of the cause of data loss.
Testing Hetman Partition Recovery

The program was able to find all the files without effort; both the existing files and the removed files are displayed, and the ones that have been deleted are marked with a red cross. Their contents can be previewed if necessary. The disk structure and file names are retained.

Testing Hetman Partition Recovery

All we have to do is to save the recovered files to a disk.

Testing RStudio

This program also recognizes the test disk and identifies the file system type properly.

Testing RStudio

However, after a quick scan it can’t display any removed data.

Testing RStudio

After the full scan, the program managed to find the deleted data, and marked it with a red cross. The disk structure and file names are retained, and the files are available for preview.

Testing RStudio

Testing EaseUS

This program displays the test disk, but we could only identify it by its size, because neither its name nor file system type are shown.

Testing EaseUS

There is no such thing as a quick scan here, so advanced scan starts immediately.

In the end, EaseUS fails to display the disk structure (as the other two candidates did), file names are lost, and the files are only sorted to folders by file type. There are no markings to suggest if this is the deleted data or the data which is still on the disk, so it’s hard to tell whether the program was able to find only removed files, or it decided to display all the files.

Testing EaseUS

The only hint we could use was the number of documents, photos and videos which is shown in each folder.

Testing EaseUS

This program has coped with the task, though it took more time, and it was unable to restore the directory tree!

Summing up, all the candidates have passed the first test, but some were rather inconvenient to use.

By the way, here’s one more important remark – EaseUS has no option to save a disk image and then mount it and use for further recovery operations, which is quite unsafe when you’re dealing with cases of data loss. Every time you run the scan, there is a risk of losing important data so the best way to scan the disk is actually using its image rather than the actual volume. Such approach will increase the chances to recover files without causing additional damage.

Container Superblock removed

We have decided to make things more complicated and simulate damage to the container superblock, which is located in the first two sectors of the test disk.

Using a Hex editor, we have erased these two sectors. After that, we have scanned the disk with each of the utilities and received some interesting results.

HEX editor

Testing Hetman Partition Recovery

Just as before, the program recognizes the disk and its size, but fails to “see” the file system because the Container Superblock containing this information has been erased.

Testing Hetman Partition Recovery

In this case, fast scan is no longer available, so we had to use full analysis.

As a result, the program has identified a container with APFS file system.

Testing Hetman Partition Recovery

The disk name has changed.

Testing Hetman Partition Recovery

Hetman Partition Recovery has found all the removed data, all the files are displayed, both those that have been on the disk, and the ones that have been deleted. The disk structure and file names are retained.

Testing Hetman Partition Recovery

The program has coped with the second test as well. All data is available for recovery.

Testing Hetman Partition Recovery

Testing RStudio

It can recognize the container, but a quick scan is no longer available.

Testing RStudio

After a full scan, RStudio was able to find the test disk and identified its file system as APFS.

Testing RStudio

The disk structure and file names are retained, all data can be located.

Testing RStudio

The program has completed the second test successfully.

Testing EaseUS

No changes here, the disk is displayed as before.

Testing EaseUS

After the scan, we opened each of the folders to see the same result as in the previous test: all the data has been found.

Testing EaseUS
Testing EaseUS
Testing EaseUS

All the utilities have passed the second test successfully. They managed to discover all the lost files without effort.

Volumes removed, with data on APFS internal partitions

In the next test, in addition to the Container Superblock, we have removed volumes, i.e. the information on the disks inside the APFS container.

Testing Hetman Partition Recovery

No changes again. The program displays the disk just as before.

Testing Hetman Partition Recovery

All the files are available for further actions, just like in the previous test. The disk structure and file names are retained.

Testing Hetman Partition Recovery
Testing Hetman Partition Recovery

Hetman Partition Recovery has successfully completed the third test.

Testing RStudio

The result is the same as before. The program displays the container just as it did.

Testing RStudio

All files are available, the file names and disk structure are retained.

Testing RStudio

RStudio has passed the third test successfully.

Testing EaseUS

This utility also displays the disk without changes.

Testing EaseUS

It was able to find all the data.

Testing EaseUS

It is a bit inconvenient, though, that the program doesn’t display the disk structure, and you need more time to understand that all the files have been found.

Testing EaseUS

The test results are good for all the programs. All files are available for recovery.

Object map removed

In the next test, in addition to what we’ve done before, we have erased the object map and volumes map, to simulate a case with damaged container superblock, volumes, object map and volumes map.

Testing Hetman Partition Recovery

Just as before, the program recognizes the disk and its size, but fails to “see” the file system.

Let’s scan the disk in Hetman Partition Recovery.

Testing Hetman Partition Recovery

All the lost files are available and can be previewed.

Testing Hetman Partition Recovery

The disk structure and file names are retained.

Testing Hetman Partition Recovery

The program has completed this test successfully.

Testing RStudio

The program displays the container properly.

Testing RStudio

With quick scan, the program couldn’t find the test disk.

Testing RStudio

As it appears, when the object map and volumes map are removed, the program’s algorithm has no way to find any information about the disk, and can’t find its data either.

It says, the selected disk doesn’t contain any supported file systems or the file system is corrupted. Select the Scan command from the Drive menu to find all partitions that have ever been located on the same disk space.

A deeper scan and signature search could be more productive, but it takes much longer and it doesn’t restore the folder structure, file names and so on, so that is why we have decided not to run it.

However, if you are interested to see a deeper scan test, leave a comment under this video.

Summing up, RStudio has failed the fourth test.

Testing EaseUS

EaseUS managed to find the lost data with the same result as in the previous test.

Testing EaseUS
Testing EaseUS

Most likely, it is using in-depth analysis when scanning the disk, because the default option is to have files sorted into folders by file type. Such type of analysis requires a lot of time and fails to retain the file names and folder structure, which makes searching for specific data more difficult.

Still, the program has coped with the task, and we can begin the final test.

B-tree structure removed

I’ve already mentioned that APFS is based on a B-tree pattern with branch nodes referring to following nodes of the tree until they reach leaf nodes. In the last test, we have simulated a situation when one of the nodes (or all of them) are removed. We have removed the entire tree structure, leaving only the clusters we need.

Testing Hetman Partition Recovery

With full analysis, the program has been able to find all the data on the disk – both the removed information and the files still available; disk structure and file names are retained, all files being available for preview.

Testing Hetman Partition Recovery

The only step left to take is to save them to a disk.

Testing Hetman Partition Recovery

We have excluded RStudio from this test as it failed the previous one, and we expect the same should happen again.

Testing EaseUS

Here’s the result: 18 files have been found.

Testing EaseUS

Checking the folders, we can see that all files are still on the disk.

Testing EaseUS

Similarly to the previous tests, the disk structure is missing as well as file names, and it’s difficult to find the lost information. In a scenario involving large numbers of files, it is going to take a really long time to rummage through every folder until you can find the specific files you need. However, the program has managed to find the lost data.

Testing EaseUS

Conclusion

As the benchmark results suggest, there are two tools that have passed all the tests – Hetman Partition Recovery and EaseUS Data Recovery Wizard. RStudio has failed one of the last tests and dropped out just before the final round. The choice of the best recovery solution to save your data is up to you.

The algorithm used in our product allows to retain the folder structure and file names which makes it easier to search for certain data and saves your time. Also, Hetman Partition Recovery lets you create a disk image and then recover data from there, which is the industry standard for dealing with faulty drives. Unfortunately, EaseUS Data Recovery Wizard doesn’t offer this option.

Vladimir Artiukh

Author: , Technical Writer

Vladimir Artiukh is a technical writer for Hetman Software, as well as the voice and face of their English-speaking YouTube channel, Hetman Software: Data Recovery for Windows. He handles tutorials, how-tos, and detailed reviews on how the company’s tools work with all kinds of data storage devices.

Oleg Afonin

Editor: , Technical Writer

Oleg Afonin is an expert in mobile forensics, data recovery and computer systems. He often attends large data security conferences, and writes several blogs for such resources as xaker.ru, Elcomsoft and Habr. In addition to his online activities, Oleg’s articles are also published in professional magazines. Also, Oleg Afonin is the co-author of a well-known book, Mobile Forensics - Advanced Investigative Strategies.

Recommended For You

Hello! This is AI-based Hetman Software virtual assistant, and it will answer any of your questions right away.
Start Chat