Wanted: Technical info on HFS+ filesystem

[maximus]

I have done some searching, and have come up blank. I would really like a document or documents that can give me the technical information needed to perform a raw extraction of data from an HFS / HFS+ partition.

For NTFS I was able to locate a nice forensics document (NTFS Forensics: A Programmers View of Raw Filesystem Data Extraction by Jason Medeiros). This gave me most of the information I needed. Now I am looking for something similar for HFS+. Any help in my search (including giving me search parameters that would give me results) would be greatly appreciated.

[jono-ats]

Do a Google search on:

Technical Note TN1150_ HFS Plus Volume Format.pdf

[LarrySabo]

I know nothing of forensics nor HFS, but found quite of few hits when I search on "HFS Forensics Raw Filesystem Data Extraction " that look potentially helpful, e.g.: http://www2.tech.purdue.edu/cit/Courses ... raiger.pdf to name just one.

[maximus]

My problem is that all of the results that I have found so far (including the Technical Note TN1150_ HFS Plus Volume Format.pdf document) offer very limited insight into an actual raw read from scratch. Most of the results show how to use 3rd party utilities such as sluethkit. I want the information that would tell me the full structure right from the boot sector and on. I want to be able to do raw reads from the disk and process all the information myself. Search for "HFS+ File System SangJun Jeon". It should lead you to a pdf document that is more like what I am looking for. Except I would like it all in English and not Koren! Even as it is, that document might be my best start. But if anyone can tell me how to find something better, I would be very grateful.