Knowledgebase:
HFS+ Filesystem
Posted by Jack H. Ward, Last modified by Jack H. Ward on 05 February 2018 04:46 AM

File System/Folder Node Properties (HFS+)

When you click a node, its properties are displayed in the Properties pane. Depending on its type, a node will have the following properties:

Property name

Comments

Screenshot

File system node (HFS+)

Block Count

The total number of blocks in the file system.

Block Size

The size of blocks in the file system in bytes.

File Count

The number of files in the node.

Folder Count

The number of folders in the node.

Free Block Count

The number of free blocks in the file system.

HFS Type

The type of the HFS file system.

Last Mounted Version

The size of the version that was last mounted.

Version

The number of the version.

Volume Check Date

Date and time of the last volume check.

Volume Creation Date

Date and time of the volume creation.

Volume Modification date

Date and time of the volume modification.

Creation Date

Date and time of the file creation.

Name

Name of the file.

Source

The full path to the file.

Subfolder node (HFS+)

Date Accessed

Date and time of the last access.

Date Created

Date and time of creation.

Date Modified

Date and time of modification.

File Class

Specifies how the file was extracted from the evidence.

Name

Name of the file.

File ID

The file identifier.

Invisible

The property is NO if the file is visible.

Name Locked

The property is NO if the file can be renamed and the icon can be changed.

Valence

The number of files and folders directly contained by this folder.

GID

The group ID for the file.

UID

The user ID for the file.

UNIX Permission

Specifies the unix-style permissions for the file.

File Properties (HFS)

File properties are displayed in the Properties pane when a file is selected in the Data View pane. File properties are displayed both for existing and deleted files.

Each file has the following properties:

Property

Comments

General

Date Accessed

Date of the file last access.

Date Created

Date of the file creation.

Date Modified

Date of the file modification.

File Class

Specifies how the file was extracted from the evidence.

File Size

The size of the file in bytes.

Name

The full name of the file.

Physical Size

The physical size of the file in bytes.

Start Cluster

The number of the cluster from which the file begins.

HFS+

File Creator

The four-byte creator identifier for the file.

File ID

The file identifier.

File Type

The four-byte type identifier for the file.

Invisible

The property is NO if the file is visible.

Locked

The property is NO if the file is not locked.

Name Locked

The property is NO if the file can be renamed from the Finder and the icon can be changed.

Unix Security Attributes

GID

The group ID for the file.

UID

The user ID for the file.

Unix Permission

Specifies the unix-style permissions for the file.



Attachments 
 
 Filesystem HFS 1.png (8.42 KB)
 Filesystem HFS 2.png (11.28 KB)
 Filesystem HFS 3.png (10.98 KB)
(0 vote(s))
Helpful
Not helpful

Comments (0)