Data Recovery for HFS Plus: File System for Macintosh

HFS Plus or HFS+ is a file system developed by Apple Computer to replace their Hierarchical File System (HFS) as the primary file system used on Macintosh computers. HFS Plus is also referred to as Mac OS Extended.

HFS Plus is an improved version of HFS and it supports much larger files (block addresses are 32-bit length instead of 16-bit) and using Unicode for naming the items.

HFS Plus permits filenames up to 255 characters in length, and n-forked files similar to NTFS. Mac OS has never implemented support for forks other than the data fork and resource fork. HFS Plus also uses a full 32-bit allocation mapping table, rather than HFS's 16 bits.

Design of the HFS Plus

Design of HSF Plus depends on following four:

Efficient use of disk space
File names
Future supports for named forks
Booting on other operating systems

Efficient Use of Disk Space
HFS Plus uses 32-bit values to identify allocation blocks. Thus it allows up to 2 32 (4,294,967,296) allocation blocks on a volume. More allocation blocks means a smaller allocation block size, especially on volumes of 1 GB or larger, which in turn means less average wasted space. Since the available space can be more finely distributed among a larger number of files you can have more files. This change is especially beneficial in cases where the volume contains a large number of small files.

File Names
HFS Plus uses up to 255 Unicode characters to store file names. Allowing up to 255 characters makes it easier to have very descriptive names. Long names are especially useful when the name is computer-generated.

An HFS Plus file name can occupy up to 512 bytes. Since a B-tree index node must store at least two keys (plus pointers and node descriptor), the HFS Plus catalog must use a larger node size. The typical node size for an HFS Plus catalog B-tree is 4 KB.

In HFS Plus, the keys in an index node may occupy a variable amount of space determined by the actual size of the key. This allows for less wasted space in index nodes and creates, on typical disks, a substantially larger branching factor in the tree.

Future Support for Named Forks
HFS Plus has an attribute file, another B-tree that can be used to store additional information for a file or directory. Since it is part of the volume format, this information can be kept with the file or directory as is it moved or renamed, and can be deleted when the file or directory is deleted. The contents of the attribute file's records have not been fully defined yet, but the goal is to provide an arbitrary number of forks, identified by Unicode names, for any file or directory.

Booting on Other Operating Systems
HFS Plus defines a special startup file, an unstructured fork that can be found easily during system startup. The location and size of the startup file is described in the volume header. The startup file is especially useful on systems that don't have HFS or HFS Plus support in ROM. The startup file is a generalization of the HFS boot blocks, one that provides a much larger, variable-sized amount of storage.

HFS Plus Volume

HFS Plus volumes are divided into sectors (called logical blocks in HFS), which are usually 512 bytes in size. These sectors are then grouped together into allocation blocks which can contain one or more sectors. The number of allocation blocks depends on the total size of the volume. HFS Plus uses a larger value to address allocation blocks than HFS, 32 bits rather than 16 bits; this means it can access 4,294,967,296 (=232) allocation blocks rather than the 65,536 (=216) allocation blocks available to HFS.

HFS plus volume consists of following structures:

Sectors 0 and 1 of the volume are HFS boot blocks. These are identical to the boot blocks in an HFS volume. They are part of the HFS wrapper.
Sector 2 contains the Volume Header that is equivalent to the Master Directory Block in an HFS volume. The Volume Header stores a wide variety of data recovery information about the volume itself as it includes the size of allocation blocks, a timestamp that indicates when the volume was created or the location of other volume structures such as the Catalog File or Extent Overflow File. The Volume Header is always located in the same place.
The Allocation File is used to keep track of which allocation blocks are free and which are in use. Each allocation block is represented by one bit. A zero means the block is free and a one means the block is in use. In HFS plus Volume, the Allocation File is stored as a regular file, it does not occupy a special reserved space near the beginning of the volume. The Allocation File can also change size and does not have to be stored contiguously within a volume.
The Catalog File is a B*-tree that contains records for all the files and directories which are stored in the volume. The HFS Plus Catalog File is much similar to the HFS Catalog File A record in the HFS Catalog File is 512 bytes in size, a record in the HFS Plus Catalog File is 4KB in Mac OS and 8KB in Mac OS X. HFS fields are of fixed size but this size can vary in HFS Plus depending upon the actual size of the data they store.
The Extents Overflow File is another B*-tree that records the allocation blocks that are allocated to each file as extents. Each file record in the Catalog File is capable of recording eight extents for each fork of a file; once those are used extents are recorded in the Extents Overflow File. Bad blocks are also recorded as extents in the Extents Overflow File. In Mac OS and Mac OS X, the default size of an extent record is 1KB and 4KB respectively.
The Attributes File is a new B*-tree in HFS Plus that does not have a corresponding structure in HFS. The Attributes File can store three different types of 4KB records: Inline Data Attribute records, Fork Data Attribute records and Extension Attribute records.
The Startup File is designed for non-Mac OS systems that don't have HFS or HFS Plus support. It is similar to the Boot Blocks of an HFS volume.
The second to last sector consists of the Alternate Volume Header which is equivalent to the Alternate Master Directory Block of HFS. 9) The last sector in the volume is reserved for use by Apple. This sector is used during the computer manufacturer process.

For data recovery, visit www.optimumrecovery.com