APFS snapshot for forensic data analysis