Chapter 4. Solutions in this chapter
- HFS Plus Volumes
- Boot Blocks
- Volume Header
- Allocation File
- B*-trees
- Summary
- Solutions Fast Track
- Frequently Asked Questions
Introduction
It is important for computer forensic investigators to understand how an operating system stores data on the file system. Many investigators are familiar with the FAT and NTFS file systems, which they come across routinely when doing forensic examinations on computers with Microsoft Windows. If you are going to perform computer forensics on a Mac, an iPod, or an iPhone, however, you have to have an understanding of the HFS Plus file system.
HFS Plus was developed by Apple to help overcome some of the limits imposed by their HFS file system. As disk size increases, limitations ...
Get Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
