There is a lot published about NTFS file systems, but does anyone know any good references to get deep into understanding HFS+ in Hex? Any help would be appreciated.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group

I had already researched this recently, here are my notes...


You might want to read "Mac OS X and iOS Internals: To the Apple's Core" By Jonathan Levin

http://ntfs.com/hfs.htm

http://www.mac4n6.com/
snippets:
"In my new SANS FOR518 - Mac Forensic Analysis class I have the students parse by hand certain aspects of an HFS+ file system. "
"FOR518 Reference and HFS+ Reference Sheet" there is a link to PDF, and other resources
"For those that want to learn more about HFS+, I highly recommend the following references:

•Apple Tech Note 1150
•The Sleuth Kit Source
•Mac OS X Internals: A Systems Approach by Amit Singh – Chapter 12
•Mac OS X and iOS Internals: To the Apple’s Core by Jonathan Levin – Chapter 16
•Apple Open Source "


The references in this PDF:
[url]pages.cs.wisc.edu/~legault/miniproj-736.pdf[/url]

That should be enough to keep you going for a while!

Thanks for taking the time for such a detailed reply. I really appreciate it.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group