- Practical Mobile Forensics
- Rohit Tamma Oleg Skulkin Heather Mahalik Satish Bommisetty
- 340字
- 2021-06-24 16:39:04
The HFS Plus volume
The HFS Plus volume contains a number of internal structures to manage the organization of data. These structures include a header, an alternate header, and five special files: an allocation file, an extents overflow file, a catalog file, an attributes file, and a startup file. Among the five files, three files (the extents overflow file, the catalog file, and the attributes file) use a B-Tree structure. This is a data structure that allows data to be efficiently searched, viewed, modified, or removed. The HFS Plus volume structure is shown in the following diagram:

The HFS Plus volume structure
The volume structure is described as follows:
- Reserved (1024 bytes): This is reserved for bootloader information.
- Volume Header: This stores volume information, such as the size of allocation blocks, a timestamp of when the volume was created, and metadata about each of the five special files.
- Allocation File: This file is used to track which allocation blocks are in use by the system. The file format consists of 1 bit for every allocation block. If the bit is set, the block is in use. If it is not set, the block is free.
- Extents Overflow File: This file records the allocation blocks that are allocated when the file size exceeds eight blocks, which helps in locating the actual data when referred. Bad blocks are also recorded in the file.
- Catalog File: This file contains information about the hierarchy of files and folders, which is used to locate any file and folder within the volume.
- Attributes File: This file contains inline data attribute records, fork data attribute records, and extension attribute records.
- Startup File: This file contains the information needed to assist in booting a system that does not have HFS Plus support.
- Alternate Volume Header: This is a backup of the volume header, and it's mainly used for disk repairing.
- Reserved (512 bytes): This is reserved for use by Apple, and it is used during the manufacturing process.
Next, let's look at the APFS filesystem.
推薦閱讀
- Metasploit Penetration Testing Cookbook(Second Edition)
- 走進新安全:讀懂網絡安全威脅、技術與新思想
- 網絡安全技術及應用(第3版)
- 網絡空間安全實驗
- 學電腦安全與病毒防范
- 黑客攻防從入門到精通
- Cybersecurity Threats,Malware Trends,and Strategies
- 華為Anti-DDoS技術漫談
- 云計算安全防護技術
- 網絡空間安全實戰基礎
- 黑客攻防與電腦安全從新手到高手(超值版)
- 動態賦能網絡空間防御
- 惡意軟件、Rootkit和僵尸網絡
- 中國網絡空間安全前沿科技發展報告(2018)
- Python Penetration Testing Essentials