APFS and Jamf Admin: Essential Information

With more than 19 years of Mac support under his belt in higher education, government, medical research and advertising environments, Rich Trouton has more than enough experience with the Apple platform to discuss the basics of Apple’s new file system, APFS. In today’s session, he did just that by deciphering how this new file system impacts a Mac deployment, as well as how to use Jamf Pro to mitigate risks in this new world.

Trouton began the presentation with a look at HFS Plus – the file system most Mac administrators used throughout their careers. “The HFS Plus file system was introduced with Mac OS 8.1 in 1998 and was designed to fix a block allocation issue in HFS, Apple’s previous file system,” he explained. He added that over the years, Apple added new features to HFS Plus, which was used on macOS, iOS, tvOS and watchOS. Trouton dug deeper into the capabilities and limitations of HFS Plus before moving to what is the new norm for Apple users – APFS.

Trouton said, “With HFS Plus showing its age and its legacy roots, Apple made the judgement that continuing to maintain and evolve this 19-year-old file system is no longer tenable. Apple needs a new file system, and Apple File System is being born from that need.” He went on to explain a number of new APFS features that aren’t available in HFS Plus. They include:

64-bit block allocation: This is an improvement over the 32-bit support in HFS Plus and allows APFS to support more than nine quintillion files on a single APFS volume. (In place of HFS Plus’s four billion.)

Nanosecond time stamps: APFS supports one nanosecond timestamp granularity, which improves on HFS Plus’s one-second time stamp granularity.

Sparse file support: APFS supports the use of spare files, which allows it to handle empty space in files more efficiently than HFS Plus.

Snapshot support: APFS includes support for capturing file system snapshots. Currently, only Time Machine has entitlements to use snapshots.

Atomic Safe-Save: “This capability performs saves in a single transaction that, from the user’s perspective, either completes successfully or the save doesn’t happen. This addresses the problem of a file write only partially completing, which may cause more issues than the write not happening at all,” Trouton explained.

Extended Attributes support: Both APFS and HFS Plus include Extended Attribute support, but APFS includes native support for Extended Attributes. HFS Plus had to be retrofitted to allow this capacity.

After describing the aforementioned features that come with APFS, Trouton took a look at its structure. “Containers are the base storage unit of APFS. They are pools of storage, which are conceptually similar to CoreStorage’s logical volume groups,” he explained. “Each volume then generally maps to a matching namespace, which Apple is defining as meaning sets of files and directories.”

So what next? Trouton described the not-so-distant Mac admin future. “When Macs are upgraded to High Sierra, their boot drives may or may not be converted automatically to APFS,” he said. “Apple has stated that the conversion criteria is based on the type of drives.” He added that there is no opt-out from the conversion process. But do you need to use APFS on High Sierra?

“No,” Trouton said. “HFS Plus remains fully supported as of macOS High Sierra.” He added that he does believe Apple will phase out HFS Plus support in the future. With that said, is imaging dead?

While Trouton said it lives on on HFS Plus, the future of imaging on APFS is unclear. He explained saying, “AutoDMG supports building APFS images on 10.13. However, there are EFI updates, which will only be available from the High Sierra OS installer. And it must be applied before a Mac will be able to boot from APFS volumes. That means the OS installer will need to run at least once on a particular Mac before you’ll be able to start applying APFS images to it.”

Trouton spent the remainder of the session demoing ways to successfully manage the new file system, including how to work with APFS volumes and containers and navigating cloning. He discussed how to convert saying, “This conversion process is designed to non-destructively convert drives formatted with HFS Plus to now use the APFS file system. For this to work, however, drives will have to be unmounted.”

While AFPS supports multiple encryption models, such as no encryption, per-volume encryption and per-file encryption, it will use AES-XTS or AES-CBC encryption. AES-XTS will be used for macOS devices and iOS devices with A8 processors; iOS devices without A8 processers will use AES-CBC encryption.

Trouton concluded the session with a key piece of information: “Because bad things can happen to good drives, if you want to fix a malfunctioning APFS drive, run the FSCK APFS command with root privileges.”