Join Us!

Catalog Files on HF...
 
Notifications
Clear all

Catalog Files on HFS+  

  RSS
DazM
 DazM
(@dazm)
New Member

I am trying to breakdown the hex of a catalog file however am struggling to work out what areas relate to date/times of file creation.

Does any one have any information on how a catalog file is constructed (hex wise)? A search on Google has not helped at all.

Quote
Posted : 24/06/2015 8:30 pm
jaclaz
(@jaclaz)
Community Legend

Doesn't these provide the needed info?
http//forensicswiki.org/wiki/HFS%2B
http//web.archive.org/web/20090214212148/http//developer.apple.com/technotes/tn/tn1150.html

This tool should provide a template for HFS+ Catalog File (nodes)
http//disk-editor.org/

or however you can create a tempate (grammar) for the format with a tool like (examples)
http//www.synalysis.net/
if you are on Windows
https://hexinator.com/

jaclaz

ReplyQuote
Posted : 24/06/2015 9:18 pm
Share: