Which File System is Best for Mac Forensic Imaging?

HFS+ and APFS vs exFAT and NTFS: Which File System is Best for Mac Forensic Imaging?

There are many options when it comes to choosing the destination drive format for Mac forensic imaging. But not every file system behaves or performs the same way. We’ll examine exFAT, NTFS, HFS+ and APFS in this post to see which is better for Mac forensic imaging.

HFS+ and APFS

HFS+ and APFS are the native file systems for macOS and are the most commonly used file systems for Mac forensic imaging. HFS+ has been used on macOS since 1998, while APFS was introduced in macOS High Sierra in 2017.

HFS+ is a mature and stable file system that has been widely used on macOS for over two decades. It is known for its robustness and reliability, making it an ideal choice for forensic imaging. HFS+ supports features such as journaling, which helps to prevent data loss and corruption in the event of a power failure or system crash. HFS+ is also a widely used format due to its simplicity, especially when compared to its newer counterpart, APFS.

APFS is a modern file system designed specifically for macOS devices. It was introduced to improve performance, security, and reliability on macOS devices. APFS also supports features such as cloning and snapshots, which make it easier to create and manage forensic images.

Both HFS+ and APFS are compatible with macOS devices, which means that they preserve important file system metadata, specifically the extended attribute data. This is essential for forensic investigations, as it allows examiners to more accurately describe how a file ended up on the file system and how a user has interacted with the file. More information about this information can be read about in our previous blog.

Another advantage of using HFS+ and APFS for Mac forensic imaging is their ability to handle large files and volumes efficiently. HFS+ and APFS are both designed to handle large files and volumes with ease, which helps to speed up the imaging process and minimize the risk of errors.

ExFAT and NTFS

ExFAT and NTFS are file systems commonly used on external drives. While they may be suitable for certain imaging scenarios, they have limitations when it comes to Mac forensic imaging.

ExFAT is a non-native file system for macOS, which means that it may not preserve all file system metadata and timestamps during imaging. This can make it difficult to verify the integrity of the data during the forensic investigation, as well as determine a user’s interaction with particular files. This can be easily demonstrated with the existence of Apple Double Files. As HFS+ and APFS have specific ways of storing a file’s metadata when that data is brought to a non-native file system like exFAT, Mac has to create what’s known as an Apple Double File to attempt to preserve its metadata. This can cause a number of important artifacts to be lost due to the file system incompatibility. In addition, exFAT has been known to cause errors when imaging datasets and has been known to unmount partway through an acquisition in the past.

NTFS, on the other hand, is not natively writable on macOS without additional software. This can complicate the imaging process and increase the risk of errors or data corruption during the imaging process. While it is possible to use NTFS with third-party software, this can introduce additional variables that may affect the integrity of the data, and most commercial forensic tools do not have these drivers loaded by default.

Which File System is Best for Mac Forensic Imaging?

In conclusion, HFS+ and APFS are the preferred file systems for Mac forensic imaging due to their native compatibility with macOS, ability to preserve important file system metadata, and their reliability even under intense loads. ExFAT and NTFS are likely not suitable destination drive formats, as they have limitations that make them less ideal for forensic investigations on macOS devices. Examples of this include their inability to properly store Apple Metadata, timestamps, and may not include write permissions by default. When selecting a file system for your Mac imaging destination drive, it is important to consider factors such as data integrity, compatibility, and support to ensure accurate and reliable results.

Ensure you keep your reputation by utilizing Mac-native solutions that have full support for both HFS+ and APFS. SUMURI’s Mac-Native Imaging Solution, RECON ITR, has full support for imaging HFS+ and APFS formatted containers, to HFS+ and APFS formatted drives to ensure that case-solving metadata is properly preserved. SUMURI’s Mac-Native Analysis Suite, RECON LAB, has support for images of either format and even is the only solution to properly utilize Mac Technologies to properly parse case-solving metadata.