Biskus APFS Capture

The first and only software to read APFS volumes for forensics analysis (DFIR).

Download Windows Trial Windows Trial Version
Download Mac Trial Mac Trial Version
Buy Now - Early Bird Special

Features

While there are many programs available for capturing disk contents in general, Biskus APFS Capture is currently the only one that performs these operations on Apple's new APFS file system format.

Disk Reports

CSV Report

The CSV Report file lets you search the metadata of every file in a spreadsheet program such as Microsoft Excel or Apple's Numbers.

SQLite Report

The SQLite Report file gives you even more control over all APFS metadata because it's organized the same way as the on-disk APFS directory structures, giving you individual access to every named key, inode, xattr and extent record, including CNIDs and block numbers. This enables you to perform powerful searches for hardlinks, cloned file content and other relatioships the flat CSV file can't offer. You can even use this information to access every file extent on disk yourself, e.g. for integration into other forensic toolkits, such as TheSleuthKit.

Windows and Mac Support

The program runs on macOS 10.9 and later, and on Windows 7 and later. Linux may be supported later as well.

macOS High Sierra

Windows 10

Further Development

The program is still getting improved.

A major goal is to unlock decrypted volumes (provided the recovery key or password is known, of course).

Many more options are possible: Search, file preview, scripting. Let us know what you require and we'll see what can be done.

Questions, Feedback, Special Requests?

Contact

support@biskus.com (Thomas Tempelmann)

Evaluation Licenses

Are you a blogger, journalist or other influential person in this field? Contact me for a free license.