APFS is a file system that supports encryption at the volume level. Each volume has its own encryption key, called the Volume Encryption Key (VEK), which is stored in the APFS container metadata and protected by another key, called the Key Encryption Key (KEK). The KEK is derived from the user's password and wrapped by a secure token, which is a feature that ensures only authorized users can access the encrypted data. According to the Apple Device Support Reference Materials12, the following scenarios cause APFS volumes to generate encryption keys:
* During user creation. When a new user is created on an APFS volume, a secure token is generated for that user and a KEK is derived from the user's password. The KEK is used to encrypt the VEK and store it in the metadata.
* During the first user's password creation. When the first user on an APFS volume sets their password, a secure token is granted to that user and a KEK is derived from the password. The KEK is used to encrypt the VEK and store it in the metadata.
* After erase content and setting. When a user erases all content and settings on an APFS volume, the VEK and the KEK are deleted and new ones are generated. The new VEK is encrypted with the new KEK and stored in the metadata.
References:
* Use secure token, bootstrap token, and volume ownership in deployments.
* Data Protection in Apple devices.