APFS takes a different approach as it creates checkpoints at regular time intervals, preserving all information about deleted files, as long as this information has not been purged. After you click on an APFS file system, GetDataBack prompts you to include old (and possibly deleted) file system states.
|$10||Standard information||contains time stamps and DOS attributes|
|$30||Filename||contains the file's name for different namespaces (usually NT's native Unicode filename and DOS compatible DOS filename)|
|$80||Data||if the entry represents a file, this attribute contains the file's data|
|$90||Index root||if the entry is a directory, this attribute describes the root of a binary tree of directory entries|
|$A0||Index allocation||if the entry is a directory, this attribute contains a list of filenames|