HFS+ File System Analysis and Forensics with fileXray

Modern filesystems are highly optimized database systems that are a core function of modern operating systems. They allow concurrent access by many CPUs, they keep locality up and fragementation down, and they can recover from crashes guaranteeing consistent data structures.

If you want to learn about the internals of modern filesystems, you can either read up on theory (e.g. Dominic Giampaolo’s excellent free book Practical File System Design), or you can dissect one using a tool like fileXray, which

  • allows you to examine data structures on your Mac OS X HFS+ disk, like the volume header, the journal, regular and special files, etc., down to the B-tree level
  • gives you insight into statistics like fragmentation and hot file clustering
  • lets you find out where all these deleted files really go, and what forensic analysis can tell someone about your disks!

4 thoughts on “HFS+ File System Analysis and Forensics with fileXray”

  1. BTW, my tool “iBored” is also quite useful for looking at disk and file systems. It has a dynamic template system and can detect many types of blocks automatically. Find it here: apps.tempel.org

    Reply

Leave a Comment