Forensics: APFS Forensic Analysis

Forensics: APFS Forensic Analysis

Analyze relevant new features and explain their significance in forensic investigations.


Duration: 3 – 6 months
Level: HBO / WO
Compensation: 500 euro/month


The new Apple file system, APFS, that was very recently introduced contains several new features that are very relevant from a forensic perspective. This project aims at analyzing relevant new features and explaining their significance in forensic investigations. Preferably, the project also results in a tool or plugin that parses various relevant traces from an APFS partition image.

At this moment there is still a lack of (tested) support within forensic tooling. During this assignment you will also have the possibility to include relevant (commercial) forensic tools and test them out.


During this internship you will be analysing APFS with from a forensic point of view. This will be done with the help from forensic IT experts from Fox-IT’s Forensics & Incident Response division.


Please share your CV and motivation with us (vacature[at] In case of questions please send us an email (vacature[at]

Neem contact op

+31 (0) 15 284 79 99