Crate hfsplus_forensic 

HFS+ / HFSX volume-header detection (Apple TN1150).

Apple optical discs are frequently hybrids: an ISO 9660 filesystem and an HFS/HFS+ volume sharing the same disc, so a Mac and a PC each see their own filesystem. The HFS+ volume header sits at a fixed 1024-byte offset from the volume start (TN1150 §“Volume Header”), with a big-endian H+ (HFS+) or HX (HFSX) signature.

This crate reads the volume header (geometry), walks the catalog B-tree to list directories (list_root, list_dir, recursive walk), and extracts file contents (read_file) — including HFS+/APFS transparently compressed files, which it decodes via the decmpfs module (zlib / LZVN / LZFSE, inline xattr or resource fork). Journal replay is out of scope. Validated against real hdiutil/ditto-created HFS+ volumes.

Modules

decmpfs

HFS+/APFS transparent-compression (decmpfs) decoder.

findings

HFS+ forensic findings: graded anomaly classification over the structures the reader already parses (volume header, catalog B-tree, extents-overflow B-tree, file forks, com.apple.decmpfs attributes).

Structs

HfsEntry

An entry in an HFS+ directory.

HfsPathEntry

A path-qualified entry produced by walk.

HfsVolume

Parsed HFS+ volume header fields (geometry only).

Enums

HfsKind

Which Apple volume signature was found.

Functions

list_dir

List the immediate children of the folder parent_cnid by walking the HFS+ catalog B-tree.

list_root

List the root directory of an HFS+ volume. See list_dir.

parse

Parse the HFS+/HFSX volume header from a buffer that begins at the volume start (the header is read at offset 1024). Returns None if the buffer is too short or carries no HFS+ signature.

read_file

Read a file’s data-fork contents by catalog node ID.

walk

Recursively list every file and folder in an HFS+ volume, depth-first from the root, returning /-joined paths.