Overview of Mac OS X File Systems in this article Apple’s Mac OS X uses a different approach in storing the data, when compared to the Windows and Linux. This section will make investigators aware of the file systems that different versions of Mac operating systems use.
Mac OS X File Systems
1. Hierarchical File System (HFS)
Apple had developed the Hierarchical File System (HFS) in September 1985 to support the MAC OS in its proprietary Macintosh system and as a replacement for the Macintosh File System (MFS). HFS divides the volume into logical blocks of 512 bytes each and groups these logical blocks into allocation blocks. Each allocation block can store one or more logical blocks depending on the total size of the volume. The file system uses a 16-bit value to address allocation blocks, which restricts the number of allocation blocks to 65,535.
Five structures make up an HFS volume:
Logical blocks 0 and 1 of the volume are the boot blocks, which include system startup information, for example, the names of the system and shell files, which are loaded at startup.
Logical block 2 contains the Master Directory Block (MDB). This defines a wide variety of data about the volume itself, for instance, date and time stamps of creation of the volume; the location of the other volume structures, such as the volume bitmap or the size of logical structures, such as allocation blocks. There is also a duplicate of the MDB called the Alternate Master Directory Block (Alternate MDB) located at the opposite end of the volume in the second to last logical block. This is intended mainly for use by disk utilities and is only updated when either the catalog file or extents overflow file grow in size.
Logical block 3 is the starting block of the volume bitmap, which keeps track of the allocation blocks in use and those which are free. A bit in the map represents each allocation block on the volume; if the bit is set then the block is in use, else if it is clear then the block is free.
The extents overflow file is a I3–-tree including extra extents that store information about the files and the allocation blocks allocated to them, after the system uses the initial three extents in the catalog file. Later versions also added the ability for the extents overflow file to store extents that record bad blocks, to prevent a machine from trying to write to them.
Related Product : Computer Hacking Forensic Investigator | CHFI
The catalog file is another B*-tree that holds records for all the files and directories stored in the volume. It stores four types of records. Each file consists of a file thread record and a file record, while each directory contains a directory thread record and a directory record. Unique catalog node ID helps in finding the files and directories in the catalog file.
HFS Plus (HFS+)
HFS Plus (HFS+) is a successor of WS and is a primary file system in Macintosh.
2. UFS (UNIX File System)
UFS is a file system utilized by many UNIX and UNIX-like operating systems. Derived from the Berkeley Fast File System, it is the first version of UNIX developed at Bell Labs.
Design:
A LIES file system is composed of the following parts:
- A few blocks at the beginning of the partition reserved for hoot block (which must be initialized separately from the file system)
- A super block, including a magic number identifying this as a UFS file system, and some other Vital numbers describing this file system’s geometry and statistics and behavioral tuning parameters
- A collection of cylinder groups, of which each cylinder group has the following components:
– A backup copy of the super block
– A cylinder group header, with statistics, free lists and which is similar to those in the super block
– A number of inodes, each containing file attributes
– A number of data blocks
3. Hierarchical File System (HFS)
Apple designed the Hierarchical File System (HFS) in 1985 for the Mac operating system. It allows the user to store files in a hierarchical manner. It groups files into directories and each directory also groups with other directories. It displays drives, directories, and files in groups. It divides a logical volume into logical blocks of 512 bytes. The file system then groups these blocks into an allocation block. HFS uses a 16-bit value to address allocation blocks.
Logical volume blocks 0 and 1 are the boot blocks, which contain system startup information. For example, system names and shell files loaded at startup.
The Logical block 2 has the Master Directory Block (MDB) which defines data about the volume such as date and time stamps of volume creation, location of volume structures, volume bitmap and the size of logical structures. Alternate Master Directory Block (Alternate MDB) is a duplicate of the MDB located In the opposite end of the volume and second to last logical block. Disk utilities primarily use the alternate Master Directory Block and update it only when the extents overflow file or catalog file are large in size.
The Logical block 3 is the first block of the volume bitmap. It keeps track of the allocation blocks in use as well as the blocks that are free.
The Hierarchical File System allows the user to:
- Hierarchically organize files
- Use longer file names that include embedded spaces
- Use as many levels of directories and subdirectories as needed
- Use a CIS transaction to observe and maintain HFS files
Also Read : Learn All About Linux File Systems
4. Hierarchical File System Plus (HFS+)
HFS Plus (HFS+) is a successor of HFS and is a primary file system in Macintosh. Ft supports large files and uses Unicode for naming the items (files and folders).
A few of the features added to HIS Plus are:
- HFS Plus uses B-tree to store the data
- It supports files with 64 bits in length
- It permits file names of 255 characters in length
- It uses a 32-bit allocation table for the mapping table, unlike 16 bits in HES
HFS Plus allows the user to:
- Efficiently use hard disk space.
- Use only international-friendly file names.
- Easily boot on non-Mac OS operating systems.
Also called as Mac OS Extended (HFS Extended), it is the file system of some Apple ‘Pods as well.
HFS+Volumes
HFS+ volumes have further divisions called logical blocks (sectors) of 512 bytes size. These sectors cluster into allocation blocks. The total number of allocation blocks depends on the volume size.
The bulk of an HFS+ volume consists of seven types of sectors:
- User file fork
- Allocation file
- Catalog file
- Extents overflow file
- Attribute He
- Startup file
- Unused space
An HFS+ volume is made of 9 main structures:
- Boot Blocks: Present in sectors 0 and 1 and are similar to the boot blocks found in HFS.
- Volume Header: Found in sector 2 and stores data about the volume such as timestamps, allocation blocks sizes, and locations volume structures like Extent Overflow File or Catalog File.
- Allocation File: This file maintains records of the blocks that are free as well as blocks in use and denoted by one bit. It is a regular file and does not have a reserved space at the beginning of the volume. Its size is variable and does not need contiguous storage within a volume.
- Catalog File: This is a B-tree which contains records for all files and directories stored in the volume. The HE S+ offers bigger records to provide more fields and also allows larger fields. The record fields in HFS+ can also vary based on the data stored by them.
- Extents Overflow File: This is a B-tree which records the allocation blocks allocated to each file as extents. The Catalog Files can record up to eight extents for each fork of a file and store the extra extents in the Extents Overflow File. They record even bad blocks as extents. The default file sizes are 1 KB and 4 KB in Mac OS and Mac OS X, respectively.
- Attributes File: This is a B-tree only present in HFS+ and can store three kinds of 4 KB records including Fork Data Attribute records, Inline Data Attribute records, and Extension Attribute records.
- Startup File: Developed for non-Mac OS systems, which do not have HFS or HFS+ support, the file is equivalent to the HFS volume Boot Blocks.
- Alternate Volume Header: It is present in the last but one sector of an FIES+ volume and is similar to HES Alternate Master Directory Block.
- Last sector: Reserved for Apple’s use at the time of the computer manufacturing.
HFS+ Journal
HFS+ volumes have an optional journal, which helps in mounting an unmounted volume in the case of a system crash. The journal restores the volume structures to a reliable state without scanning all of the structures. The journal info block (.journal_info_block) is stored as a file on the HFS+ volume’s root directory.
Apple added journaling features to IFS Plus with the release of Mac OS X 10.2.2 update in 2002 to improved data reliability. All HFS Plus volumes on all Macs are set with the journaling feature as default from OS X v10.3 version. The HFS Plus volume with a journal is denoted as HFSJ.
Questions related to this topic
- What file system does Mac OS X use?
- Is Mac OS Extended Journaled the same as Apfs?
- What are the Mac OS versions in order?
- How does the Mac file system work?
This Blog Article is posted by
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092
Contact us – www.info-savvy.com
