Practical Mobile Forensics - Third Edition
by Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty
The HFS Plus filesystem
In 1996, Apple developed a new filesystem, Hierarchical File System (HFS), to accommodate the storage of large datasets. In a HFS filesystem, the storage medium is represented as volumes. HFS volumes are divided into logical blocks of 512 bytes. The logical blocks are numbered from first to last on a given volume and will remain static with the same size as physical blocks, that is, 512 bytes. These logical blocks are grouped together into allocation blocks, which are used by the HFS filesystem to track data in a more efficient way. HFS uses a 16-bit value to address allocation blocks, which limits the number of allocation blocks to 65,535. To overcome the inefficient allocations of disk space and some of the limitations ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access