Practical Mobile Forensics - Third Edition

The HFS Plus filesystem

In 1996, Apple developed a new filesystem, Hierarchical File System (HFS), to accommodate the storage of large datasets. In a HFS filesystem, the storage medium is represented as volumes. HFS volumes are divided into logical blocks of 512 bytes. The logical blocks are numbered from first to last on a given volume and will remain static with the same size as physical blocks, that is, 512 bytes. These logical blocks are grouped together into allocation blocks, which are used by the HFS filesystem to track data in a more efficient way. HFS uses a 16-bit value to address allocation blocks, which limits the number of allocation blocks to 65,535. To overcome the inefficient allocations of disk space and some of the limitations ...