In January 1998 Apple replaced the Hierarchical File System (HFS) with the HFS Plus volume, often called HFS+ as the primary file system for use in Mac OS 8.1 and its later replacement, the OS X and OS X server operating systems. This was important due to the many limitations inherent with HFS data volumes, particularly important with increasing hard disk drive capacities.
HFS Plus is a stable and well known file system, for which extensive documentation is available. At DiskEng we have extensive data recovery experience from HFS Plus data volumes, ranging from damage due to physical hard drive damage through to corruption due to malware.
Features of HFS+ Data Volumes
Block addressing on HFS Plus data volumes uses 32 bit values, which when using the largest allocation block size, allows a maximum file size and data volume of up to 8EB. Apple Mac computers use data and resource forks, which are stored on an HFS+ data volume in a similar fashion to NTFS data volumes. In 2006 further additional streams have been allowed on HFS+ data volumes.
In line with many modern file systems, journaling capability was added to the HFS Plus data volume when Mac OS X v10.3 was released. Journaling enables the state of the file system to be recovered by the operating system during the boot process following a crash or power outage. Compression was added to HFS Plus when Apple released Mac OS X Snow Leopard 10.6, storing the compressed data as an extended attribute or in the resource fork.
Internal Data Structures of HFS+
The HFS Plus Volume Header is located at sector two of the file system, following a pair of blank sectors. A secondary backup copy of the Volume Header is stored in the second to last sector of the volume. The parameters required to mount the volume by the operating system, such as allocation block size, volume blocks and locations of the system areas, such as file allocation and catalog entries.
The system areas contain the Allocation File, Catalog File, Extents Overflows and Attributes File, necessary for accessing each file correctly. The files, with the exception of the Allocation File, are stored in the form of a B-Tree. A B-Tree allows for the fast and efficient sorting, searching, sequential access, insertion and deletion of entries. The file storage data blocks are located immediately after the fixed system area allocated at the time of formatting the volume. When any of these system areas are full an extent is required which is stored within the main pool of data blocks.
HFS Plus Data Volume Recovery
The design of HFS Plus which uses system areas which have no signature with which they can easily be located, means that the loss of data due to a few bad sectors or data corruption make it impossible to recover the file meta data. A similar situation also occurs when the volume is reformatted, leaving a raw data trawl as the only viable option to recover the data.
Even the simple loss of the Catalog File header, a not uncommon issue, renders the data inaccessible to the operating system and most data recovery tools. At DiskEng, our in-house developed data recovery suite is able to overcome this issue, enabling use to recover the entries held in the Catalog File.