- Practical Mobile Forensics(Third Edition)
- Rohit Tamma Oleg Skulkin Heather Mahalik Satish Bommisetty
- 328字
- 2021-06-30 19:33:06
The HFS Plus volume
The HFS Plus volume contains a number of internal structures to manage the organization of data. These structures include a header, an alternate header, and five special files: an allocation file, an extents overflow file, a catalog file, an attributes file, and a startup file. Among the five files, three files (the extents overflow file, the catalog file, and the attribute file) use a B-tree structure, a data structure that allows data to be efficiently searched, viewed, modified, or removed. The HFS Plus volume structure is shown in the following figure:

The HFS Plus volume structure
The volume structure is described as follows:
- 1024 bytes: This is reserved for boot load information.
- Volume header: This stores volume information, such as the size of allocation blocks, a timestamp of when the volume was created, and metadata about each of the five special files.
- Allocation file: This file is used to track which allocation blocks are in use by the system. The file format consists of one bit for every allocation block. If the bit is set, the block is in use. If it is not set, the block is free.
- Extents Overflow file: This file records the allocation blocks that are allocated when the file size exceeds eight blocks, which helps in locating the actual data when referred. Bad blocks are also recorded in the file.
- Catalog file: This file contains information about the hierarchy of files and folders, which is used to locate any file and folder within the volume.
- Attribute file: This file contains inline data attribute records, fork data attribute records, and extension attribute records.
- Startup file: This file holds the information needed to assist in booting a system that does not have HFS Plus support.
- Alternate Volume header: This is a backup of the volume header, and it is primarily used for disk repair.
- 512 bytes: This is reserved for use by Apple, and it is used during the manufacturing process.
推薦閱讀
- 中國(guó)古代圖書館學(xué)研究
- 李一氓文存(第二卷):存在集三編下冊(cè)
- 河南省博物院鎮(zhèn)館之寶
- 國(guó)際集郵聯(lián)合會(huì)(FIP)集郵展覽評(píng)審規(guī)則
- 圖書館學(xué)基礎(chǔ)簡(jiǎn)明教程
- 北疆博物院的故事
- 近代中國(guó)的學(xué)術(shù)與藏書
- 高校圖書館創(chuàng)新服務(wù)(谷臻小簡(jiǎn)·AI導(dǎo)讀版)
- 陜西古代文獻(xiàn)研究(第一輯)
- 公共圖書館知識(shí)產(chǎn)權(quán)信息服務(wù)體系建設(shè)
- 中外學(xué)術(shù)論文中英文摘要語(yǔ)料庫(kù)的創(chuàng)建及應(yīng)用
- 數(shù)字資源存儲(chǔ)、倉(cāng)儲(chǔ)和發(fā)布的標(biāo)準(zhǔn)規(guī)范建設(shè)
- 二十世紀(jì)圖書館與文化名人
- 北京大學(xué)中國(guó)古文獻(xiàn)研究中心集刊·第十七輯
- 檔案學(xué)的性格