Aside from the operating, the file system that any data resides on is paramount to explaining case evidence. Most common on a Macintosh computer will be the HFS+ file system. Older Macs may use the HFS file system, and some Mac OS X Macs can have UFS as their file system.
Tools
- See our Mac Forensic Tools section for great utilities to help you examine sector data and hex data.
Walk-Thrus
- HFS+ Sector Data - How to interpret the data when looking at those crazy hex values
- HFSDebug Output, how to get the same answer the Mac Way!
File System Resources
- Apple Tech Note 1150 (HFS+)
- Secrets of the GPT (GUID Partition Table Tech Note)