This utility allows you to view the contents of and detailed information on HFS-formatted disk image files, as well as extract files from those images to the BitCurator environment. HFS is a proprietary file system developed by Apple Inc. for use in computer systems running Mac OS^[1]. The HFS Explorer is included in the BitCurator environment because many of BitCurator's features (such as Sleuth Kit tools like fiwalk, which is used to generate DFXML output) cannot currently read HFS-formatted disks.

To use HFS Explorer, first image the disk using Guymager as described in this tutorial.

View and export information from HFS-formatted disk images using HFS Explorer

Step-by-step guide

Add the steps involved:

1. Open the tool by double clicking on the "Additional Tools" folder on the BitCurator desktop and then double clicking on the "HFS Explorer" icon (see Figure 1).

   Figure 1: Opening HFS Explorer.

   

2. The HFS Explorer window will open. Click on the "File" menu item in the top left corner of the window, and then select "Load file system from file" (see Figure 2).
   
   Figure 2: Navigating to the HFS-formatted file.
   
   
   

3. Choose the file you wish to explore, and click "OK" (see Figure 3).
   
   

   Note: If the file you chose isn't one of the supported file types (HFS, HFS+, HFSX), you'll receive an error message (see Figure 4).

   

   Figure 4: This error message occurs if your file is not HFS-formatted.

   
   

   
   

4. Select a file from the list and click the "Info" button for more information on a file (see Figure 5).
   
   Figure 5: Files are viewable.

5. You can now view a summary of basic information about the file, such as when the file was last modified (see Figure 6). To view more detailed information about the file, choose the "Detailed" tab from the top of the window (see Figure 7).

   Figure 6: View basic information about your file.
   

   Figure 7: View advanced information about your file.

   
   

   
   

6. To extract files from the HFS-formatted disk to the BitCurator environment, from the main HFS Explorer screen, select the files you wish to extract and then click the "Extract" button from the top left of the window (see Figure 8).

   Figure 8: Extracting files from the HFS-formatted disk.

   

7. 
   

8. 
   

9. 
   

10. 
    

Related articles

Related articles appear here based on the labels you select. Click to edit the macro and add or change labels.