| HDD GURU FORUMS http://forum.hddguru.com/ |
|
| Trying to Find Resources to Understand HFS+ in Hex http://forum.hddguru.com/viewtopic.php?f=7&t=30097 |
Page 1 of 1 |
| Author: | ddrecovery [ December 5th, 2014, 19:54 ] |
| Post subject: | Trying to Find Resources to Understand HFS+ in Hex |
There is a lot published about NTFS file systems, but does anyone know any good references to get deep into understanding HFS+ in Hex? Any help would be appreciated. |
|
| Author: | HaQue [ December 6th, 2014, 3:19 ] |
| Post subject: | Re: Trying to Find Resources to Understand HFS+ in Hex |
I had already researched this recently, here are my notes... You might want to read "Mac OS X and iOS Internals: To the Apple's Core" By Jonathan Levin http://ntfs.com/hfs.htm http://www.mac4n6.com/ snippets: "In my new SANS FOR518 - Mac Forensic Analysis class I have the students parse by hand certain aspects of an HFS+ file system. " "FOR518 Reference and HFS+ Reference Sheet" there is a link to PDF, and other resources "For those that want to learn more about HFS+, I highly recommend the following references: •Apple Tech Note 1150 •The Sleuth Kit Source •Mac OS X Internals: A Systems Approach by Amit Singh – Chapter 12 •Mac OS X and iOS Internals: To the Apple’s Core by Jonathan Levin – Chapter 16 •Apple Open Source " The references in this PDF: [url]pages.cs.wisc.edu/~legault/miniproj-736.pdf[/url] That should be enough to keep you going for a while! |
|
| Author: | ddrecovery [ December 6th, 2014, 11:15 ] |
| Post subject: | Re: Trying to Find Resources to Understand HFS+ in Hex |
HaQue wrote: That should be enough to keep you going for a while! Thanks for taking the time for such a detailed reply. I really appreciate it. |
|
| Page 1 of 1 | All times are UTC - 5 hours [ DST ] |
| Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group http://www.phpbb.com/ |
|