±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36096
New Yesterday: 7 Visitors: 169

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Catalog Files on HFS+

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

DazM
Newbie
 

Catalog Files on HFS+

Post Posted: Jun 24, 15 19:30

I am trying to breakdown the hex of a catalog file however am struggling to work out what areas relate to date/times of file creation.

Does any one have any information on how a catalog file is constructed (hex wise)? A search on Google has not helped at all.  
 
  

jaclaz
Senior Member
 

Re: Catalog Files on HFS+

Post Posted: Jun 24, 15 20:18

Doesn't these provide the needed info?
forensicswiki.org/wiki/HFS%2B
web.archive.org/web/20...n1150.html


This tool should provide a template for HFS+ Catalog File (nodes):
disk-editor.org/

or however you can create a tempate (grammar) for the format with a tool like (examples):
www.synalysis.net/
if you are on Windows:
hexinator.com/

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 

Page 1 of 1