- Practical Mobile Forensics
- Rohit Tamma Oleg Skulkin Heather Mahalik Satish Bommisetty
- 340字
- 2021-06-24 16:39:04
The HFS Plus volume
The HFS Plus volume contains a number of internal structures to manage the organization of data. These structures include a header, an alternate header, and five special files: an allocation file, an extents overflow file, a catalog file, an attributes file, and a startup file. Among the five files, three files (the extents overflow file, the catalog file, and the attributes file) use a B-Tree structure. This is a data structure that allows data to be efficiently searched, viewed, modified, or removed. The HFS Plus volume structure is shown in the following diagram:

The HFS Plus volume structure
The volume structure is described as follows:
- Reserved (1024 bytes): This is reserved for bootloader information.
- Volume Header: This stores volume information, such as the size of allocation blocks, a timestamp of when the volume was created, and metadata about each of the five special files.
- Allocation File: This file is used to track which allocation blocks are in use by the system. The file format consists of 1 bit for every allocation block. If the bit is set, the block is in use. If it is not set, the block is free.
- Extents Overflow File: This file records the allocation blocks that are allocated when the file size exceeds eight blocks, which helps in locating the actual data when referred. Bad blocks are also recorded in the file.
- Catalog File: This file contains information about the hierarchy of files and folders, which is used to locate any file and folder within the volume.
- Attributes File: This file contains inline data attribute records, fork data attribute records, and extension attribute records.
- Startup File: This file contains the information needed to assist in booting a system that does not have HFS Plus support.
- Alternate Volume Header: This is a backup of the volume header, and it's mainly used for disk repairing.
- Reserved (512 bytes): This is reserved for use by Apple, and it is used during the manufacturing process.
Next, let's look at the APFS filesystem.
推薦閱讀
- Android應(yīng)用安全實戰(zhàn):Frida協(xié)議分析
- SASE原理、架構(gòu)與實踐
- 黑客大曝光:無線網(wǎng)絡(luò)安全(原書第3版)
- Metasploit Penetration Testing Cookbook(Third Edition)
- 為你護(hù)航:網(wǎng)絡(luò)空間安全科普讀本(第2版)
- Rootkit和Bootkit:現(xiàn)代惡意軟件逆向分析和下一代威脅
- 大型互聯(lián)網(wǎng)企業(yè)安全架構(gòu)
- 走進(jìn)新安全:讀懂網(wǎng)絡(luò)安全威脅、技術(shù)與新思想
- 計算機(jī)病毒原理與防范(第2版)
- 工業(yè)物聯(lián)網(wǎng)安全
- 模糊測試:強(qiáng)制發(fā)掘安全漏洞的利器
- Instant Java Password and Authentication Security
- 軟件安全保障體系架構(gòu)
- 解密數(shù)據(jù)恢復(fù)
- 數(shù)據(jù)安全與流通:技術(shù)、架構(gòu)與實踐