You can check out the UFSD SDK capabilities by using a special “apfsutil” utility. To start it, simply implement the following:

apfsutil <test_name> [options] /dev/xxx/path/to/file/or/folder

where:
    test_name      name of the test to run (see 'User scenarios' section)

options:
   --passN=password  use password for the volume N (for encrypted volumes). APFS volumes are listed from N=1 to 100
   --trace           turn on UFSD trace
   --subvolumes      mount all sub-volumes (All sub-volumes from the container will be "mounted" in the 'Ufsd_Volumes' folder in the root)

For example:

sudo apfsutil readfile /dev/sdb1/test_folder/newfile.txt
sudo apfsutil enumfolder --subvolumes --pass1=qwerty --pass2=qwerty2 /dev/sdb1/Ufsd_Volumes/Untitled/test_folder

Example for Windows:

apfsutil enumfolder f:\test_folder

IMPORTANT NOTE! All operations are only available for unlocked (unmounted) APFS containers!

If you have found a spelling error, please, notify us by selecting that text and pressing Ctrl+Enter.