Practical Mobile Forensics
上QQ阅读APP看书,第一时间看更新

The HFS Plus volume

The HFS Plus volume contains a number of internal structures to manage the organization of data. These structures include a header, an alternate header, and five special files: an allocation file, an extents overflow file, a catalog file, an attributes file, and a startup file. Among the five files, three files (the extents overflow file, the catalog file, and the attributes file) use a B-Tree structure. This is a data structure that allows data to be efficiently searched, viewed, modified, or removed. The HFS Plus volume structure is shown in the following diagram:

 

The HFS Plus volume structure

The volume structure is described as follows:

  • Reserved (1024 bytes): This is reserved for bootloader information.
  • Volume Header: This stores volume information, such as the size of allocation blocks, a timestamp of when the volume was created, and metadata about each of the five special files.
  • Allocation File: This file is used to track which allocation blocks are in use by the system. The file format consists of 1 bit for every allocation block. If the bit is set, the block is in use. If it is not set, the block is free.
  • Extents Overflow File: This file records the allocation blocks that are allocated when the file size exceeds eight blocks, which helps in locating the actual data when referred. Bad blocks are also recorded in the file.
  • Catalog File: This file contains information about the hierarchy of files and folders, which is used to locate any file and folder within the volume.
  • Attributes File: This file contains inline data attribute records, fork data attribute records, and extension attribute records.
  • Startup File: This file contains the information needed to assist in booting a system that does not have HFS Plus support.
  • Alternate Volume Header: This is a backup of the volume header, and it's mainly used for disk repairing.
  • Reserved (512 bytes): This is reserved for use by Apple, and it is used during the manufacturing process.

Next, let's look at the APFS filesystem.