Catalog Files on HF...
 
Notifications
Clear all

Catalog Files on HFS+

2 Posts
2 Users
0 Reactions
743 Views
 DazM
(@dazm)
New Member
Joined: 13 years ago
Posts: 4
Topic starter  

I am trying to breakdown the hex of a catalog file however am struggling to work out what areas relate to date/times of file creation.

Does any one have any information on how a catalog file is constructed (hex wise)? A search on Google has not helped at all.


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Doesn't these provide the needed info?
http//forensicswiki.org/wiki/HFS%2B
http//web.archive.org/web/20090214212148/http//developer.apple.com/technotes/tn/tn1150.html

This tool should provide a template for HFS+ Catalog File (nodes)
http//disk-editor.org/

or however you can create a tempate (grammar) for the format with a tool like (examples)
http//www.synalysis.net/
if you are on Windows
https://hexinator.com/

jaclaz


   
ReplyQuote
Share: