Chapter 4. Solutions in this chapter

  • HFS Plus Volumes
  • Boot Blocks
  • Volume Header
  • Allocation File
  • B*-trees
  • Summary
  • Solutions Fast Track
  • Frequently Asked Questions


It is important for computer forensic investigators to understand how an operating system stores data on the file system. Many investigators are familiar with the FAT and NTFS file systems, which they come across routinely when doing forensic examinations on computers with Microsoft Windows. If you are going to perform computer forensics on a Mac, an iPod, or an iPhone, however, you have to have an understanding of the HFS Plus file system.

HFS Plus was developed by Apple to help overcome some of the limits imposed by their HFS file system. As disk size increases, limitations ...

Get Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit now with the O’Reilly learning platform.

O’Reilly members experience live online training, plus books, videos, and digital content from nearly 200 publishers.