Re: [sleuthkit-users] (no subject)
Brought to you by:
carrier
From: Judson P. <jp...@at...> - 2012-03-20 13:24:16
|
> Thanks a lot for sharing that information. Do you have a source for > that info, or to put it differently, are there any (current) forensics > books on HFS+? I've used Apple's Tech Note 1150, which is out of date but otherwise good; Amit Singh's "Mac OS X Internals"; and the xnu source code, which contains Apple's HFS+ driver. Documentation on HFSX can also be used. The two filesystems are identical except for their two-byte signature and for the fact that HFSX can optionally be case-sensitive (wheras HFS+ is always case-insensitive). -- Judson |