Mac OS X Forensics
Never give up, the answer is right in front of you...
-
Our Sponsors
-
Custom Search
HFSDebug
HFSDebug is a spectacular Terminal (command line) utility by Amit Singh that will read HFS+ volume header data for us from the command line. Instead of using WinHex or any other interpreters, let’s use something the way the Mac should be run. This is easy!
Here we see the same dates (except for the modified date for those with a keen eye). This picture represents only a small portion of the output this program gathers from the HFS+ volume header. It also has many other capabilities that we can use for evidence gathering!
Take a look at the home page for this utility to get a feel for its power.
HFSDebug is a spectacular Terminal (command line) utility by Amit Singh that will read HFS+ volume header data for us from the command line. Instead of using WinHex or any other interpreters, let’s use something the way the Mac should be run. This is easy!
Here we see the same dates (except for the modified date for those with a keen eye). This picture represents only a small portion of the output this program gathers from the HFS+ volume header. It also has many other capabilities that we can use for evidence gathering!
Take a look at the home page for this utility to get a feel for its power.