In an effort to give back to the DFIR community, BlackBag has released its Apple File System (APFS) source code to The Sleuth Kit for examiners all over the world to use for free.

San Jose, CA – December 21, 2018 – Within the DFIR community, support for fundamental structures, like file systems, across tools is essential for examiners to complete their work. BlackBag Technologies has provided industry-leading support for Apple devices this past year by quickly releasing complete support for Apple’s latest file system (APFS), all of the encryption variations and APFS Snapshots. With macOS and iOS rapidly driving adoption rates of this new file system, we want to make sure examiners have access to the best and most complete support for APFS.

That is why BlackBag has decided to release our source code for the APFS file system in a format that can be used by The Sleuth Kit® (TSK) framework – it is a way for us to give back to the DFIR community.

TSK is a collection of command line tools and a C library that allows examiners to analyze disk images and recover files from them. It is used behind the scenes in Autopsy and many other open source and commercial forensics tools. To learn more about what we are releasing and how the community can help, please see our Director of Research and Development, Dr. Joe Sylve, the primary developer for this support, discuss this announcement in this overview video. As of December 19, 2018, you can find BlackBag’s source code for APFS at:

BlackBag believes the work DFIR examiners do makes a difference. We are committed to providing law enforcement, government, and corporations the crucial ability to determine facts pertinent to solving criminal and civil matters and examining security incidents. We hope this holiday, and really all year, we’ve made it easier to reveal the truth. Read more on our blog here.

About BlackBag Technologies, a Cellebrite company:
Cellebrite is the global leader of Digital Intelligence solutions for law enforcement, government and enterprise organizations. Cellebrite delivers an extensive suite of innovative software solutions, analytic tools, and training designed to accelerate digital investigations and address the growing complexity of handling crime and security challenges in the digital era. Trusted by thousands of leading agencies and companies in more than 150 countries, Cellebrite is helping fulfill the joint mission of creating a safer world. To learn more visit us at or follow us on Twitter @Cellebrite_UFED