Intro Apple has developed its own file system called HFS (Hierarchical File System) for using in the Mac OS, . Currently, it was replaced by HFS +, which is used in Mac OS from version 8.1 on. The volume structure using HFS + is similar to HFS, but at the same time they slightly differ. The main characteristics of the two systems: The length of a file name: · HFS:31 · HFS+: 255. File name encoding: · HFS: Mac Roman · HFS+: Unicode Catalog node · HFS: 512 Kb · HFS+: 4 Kb Maximum file size · HFS: 2^31 · HFS+: 2^63 As you can see, HFS + was created to make the best use ofdisk spaceon large volumes and fragmented files. HFS+ from the inside HFS divides the disk space into equal-sized blocks. The 16-bit fields are used to identify a block, therefore, there can be 65,536 of such blocks in total, and each block occupies an integral number of sectors. Obviously, such a system results in a loss of much space in large volumes. In turn, HFS+ uses 32-bit values for block numbering, which allows using the space more efficiently. To manage the data arrangement on a drive, HFS+ stores control footing on it, too, that is metadata. The following are the the most critical for the file system and the most interesting to us in the search for the missing data · Volume header. Contains general information about the volume. For example, the size of the data fork and information on the location of other metadata blocks on the disk. · Allocation file. Bitmap, where the status of each block on the disk is marked. (1 - in use, 0 - free.) · Catalog file. It stores most of the data on the arrangement of files and folders on the disk. · Extents overflow file. Contains additional metadata that did not fit in the catalog file. · Attributes file. Used for access check, etc. · Journal file. Stores information about transactions committed for this volume. · Catalog file, extents overflow file and attribute file are organized as B-trees. The volume header is always stored at fixed offset 1024 bytes from the start of the volume. It contains information about the volume as a whole, including the location of other HFS+ key structures on the disk.. For example, journalInfoBlock - journal allocation, if the system has a journal, allocationFile - a block from which a map of file allocation on the disk starts, catalogFile - catalog file allocation. Read more here: https://www.dataretrieval.com/data-recovery/digging-for-apple-data-learning-how-to-recover-data-in-mac-os-x.html
...read more